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Independent Orbiter Assessment 
Analysis of the Pyrotechnics Subsystems 


1.0 EXECUTIVE SUMMARY 

The McDonnell Douglas Astronautics Company (MDAC) was selected in 
June 1986 to perform an Independent Orbiter Assessment (IOA) of 
the Failure Modes and Effects Analysis (FMEA) and Critical Items 
List (CIL) . Direction was given by the STS Orbiter and GFE 
Projects Office to perform the hardware analysis using the 
instructions and ground rules defined in NSTS 22206. Instructions 
for Preparation of FMEA and CIL. 10 October 1986 . The IOA 
approach features a top-down analysis of the hardware to 
determine failure modes, criticality, and potential critical 
items. To preserve independence, this analysis was accomplished 
without reliance upon the results contained within the NASA 
FMEA/ CIL documentation. This report documents (Appendix C) the 
independent analysis results corresponding to the Orbiter 
Pyrotechnics hardware. 

The IOA analysis process utilized available Pyrotechnics hardware 
drawings and schematics for defining hardware assemblies, 
components, and hardware items. Each level of hardware was 
evaluated and analyzed for possible failure modes and effects. 
Criticality was assigned based upon the severity of the effect 
for each failure mode. 

Figure 1 presents a summary of the failure criticalities for each 
of the 5 major subdivisions of Pyrotechnics, A summary of 
the number of failure modes, by criticality, is also presented 
below with Hardware (HW) criticality first and Functional (F) 
criticality second. 


H + 

J Summary of IOA Failure Modes By Criticality (HW/F) I 


Criticality : 

1/1 

2/1R 

2/2 

3/1R 

3/2R 

3/3 

TOTAL 

Number : 

27 

11 

3 

0 

0 

0 

41 

H 
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pyrotechnics analysis summary 

CRIT 

#FM 

#PCI 

i/i 

27 

27 

2/1 R 

11 

11 

2/2 

3 

3 

3/1 R 

0 

0 

3/2R 

0 

0 

3/3 

0 

0 

TOTAL 

41 

41 


LANDING/DECELERATION 


CRIT 

#FM 

#PC! 

1/1 

7 

7 

2/1 R 

2 

2 

2/2 

0 

0 

3/1 R 

0 

0 

3/2R 

0 

0 

3/3 

0 

0 

TOTAL 

9 

9 


ORBITER/ET SEPARATION 

CRIT 

#FM 

#PCI 

1/1 

9 

9 

2/1 R 

3 

3 

2/2 

0 

0 

3/1R 

0 

0 

3/2R 

0 

0 

3/3 

0 

0 

TOTAL 

12 

12 


RENDEZVOUS/RADAR 

CRIT 

#FM 

#PCI 

1/1 

4 

4 

2/1 R 

2 

2 

2/2 

2 

2 

3/1 R 

0 

0 

3/2R 

0 

0 

3/3 

0 

0 

TOTAL 

8 

8 


CREW STATION & EQUIPMENT 


CRrr #fm #pci 

1/12 2 
2/1 R 4 4 

2/2 0 0 

3/1 R 0 0 

3/2R 0 0 

3/3 0 0 


TOTAL 


P/L RETENTION/DEPLOY 

CRIT 

#FM 

#PCl 

1/1 

5 

5 

2/1 R 

0 

0 

2/2 

1 

1 

3/1 R 

0 

0 

3/2R 

0 

0 

3/3 

0 

0 


TOTAL 
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For each failure mode identified, the criticality and redundancy 
screens were examined to identify critical items. A summary of 
Potential Critical Items (PCIs) is presented as follows: 



Summary of IOA Potential Critical Items (HW/F) 


Criticality : 

1/1 

2/1R 

2/2 

3/1R 

3/2R 

TOTAL 

Number : 

27 

11 

3 

0 

0 

41 
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2 . 0 INTRODUCTION 


2 . 1 Purpose 

The* 51-L Challenger accident prompted the NASA to readdress 
safety policies, concepts, and rationale being used in the 
National Space Transportation System (NSTS) . The NSTS 
Office has undertaken the task of reevaluating the FMEA/CIL for 
the Space Shuttle design. The MDAC is providing an independent 
assessment of the Orbiter FMEA/CIL reevaluation results for 
completeness and technical accuracy. 


2 . 2 Scope 

The scope of the independent FMEA/CIL assessment activity 
encompasses those Shuttle Orbiter subsystems and GFE hardware 
identified in the Space Shuttle Independent FMEA/CIL Assessment 
Contractor Statement of Work. Each subsystem analysis addresses 
hardware, functions, internal and external interfaces, and 
operational requirements for all mission phases. 


2.3 Analysis Approach 

The independent analysis approach is a top-down analysis 
utilizing as-built drawings to breakdown the respective subsystem 
into components and low-level hardware items. Each hardware item 
is evaluated for failure mode, effects, and criticality. These 
data are documented in the respective subsystem analysis report, 
and are used to assess the NASA and Prime Contractor FMEA/CIL 
reevaluation results. The IOA analysis approach is summarized in 
the following Steps 1.0 through 3.0. Step 4.0 summarizes the 
assessment of the NASA and Prime Contractor FMEAs/CILs that is 
performed and documented at a later date. 


Step 1.0 Subsystem Familiarization 

1.1 Define subsystem functions 

1.2 Define subsystem components 

1.3 Define subsystem specific ground rules and 
assumptions 

Step 2.0 Define subsystem analysis diagram 

2.1 Define subsystem 

2.2 Define major assemblies 

2.3 Develop detailed subsystem representations 

Step 3.0 Failure events definition 

3 . 1 Construct matrix of failure modes 

3.2 Document IOA analysis results 
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Step 4.0 Compare IOA analysis data to NASA FMEA/CIL 

4.1 Resolve differences 

4 . 2 Review in-house 

4 . 3 Document assessment issues 

4.4 Forward findings to Project Manager 


2.4 Pyrotechnics Ground Rules and Assumptions 

The Pyrotechnics ground rules and assumptions used in the IOA are 
defined in Appendix B. 



3 . 0 SUBSYSTEM DESCRIPTION 

3.1 Design and Function 

Space Shuttle Orbiter Pyrotechnics are defined as the devices and 
assemblies operated by solid propellants or explosive devices. 

The Pyrotechnics addressed in this study are“^those that are used 
in the following applications. The Pyrotechnics used as the 
primary method for separation of the External Tank from the 
Orbiter. The Pyrotechnics used for assist and backup devices for 
Landing Gear deployment. The Pyrotechnics employed as emergency 
devices to guillotine and jettison the Remote Manipulator Arm, 
guillotine and release the Rendezvous Radar (RR) Antenna, and 
separate the outer window and open the inner window for ground 
emergency egress. 

1. Landing/Deceleration Systems Pyrotechnics are employed in 
the Nose Landing Gear (NLG) Uplock Release, Main Landing 
Gear (MLG) Uplock Release, and the NLG Extension Thruster. 
Pyrotechnic uplock thrusters serve as backup to the 
Hydraulic Deployment System for the NLG and the MLG prior 
to landing and are used only if the primary hydraulic 
system fails. The pyrotechnic NLG Extension thruster is 
used to provide mechanical assist to initiate nose gear 
and nose gear door movement against opposing air loads 
and are fired every flight whether needed or not. 

2. Orbiter/External Tank (ET) Separation Mechanisms 
employ pyrotechnic devices as the primary method to 
separate the ET from the Orbiter at one forward (fwd) and 
two aft attach points and to disconnect the Liquid 
Hydrogen (LH2) and the Liquid Oxygen (L02) umbilical 
plates. The fwd structural attach point is separated by 
fracture of a single Fwd Attach Shear Bolt. The aft 
structural attach points are separated by fracture of 
their respective Aft Attach Frangible Nut. The umbilical 
plates are separated by fracturing six frangible nuts. 

3 . Payload Retention and Deploy Jettison Pyrotechnics are 
used to guillotine the cables and jettison the remote 
manipulator arm and arm support bracket in the event 
the normal retraction stowage mechanism fails and the 
arm interferes with payload bay door closure for safe 
deorbit. 

4. Rendezvous Radar (RR) Antenna Emergency Release 
Pyrotechnics are provided to release the structural 
attachment and sever the cable in the event the normal 
RR Antenna stowage mechanism fails and emergency release 
RR Antenna is necessary to permit payload bay door 
closure. 
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3.1 Design and Function (cont'd) 

5. Crew Station and Equipment Ground Emergency Egress 

Pyrotechnics are employed to break the attach bolts to 
sever the outer window and to open the inner window. 
Window severence can be initiated from either the 
interior of the crew compartment or the exterior right 
hand side for ground crew use. The system would only 
be utilized if a failure occurs that requires crew 
egress and the entry door is jammed. 


3.2 Interfaces and Locations 

1. The Landing/ Deceleration Pyrotechnics interface with the 
Electrical Power Distribution and Control (EPD&C) Subsystem 
at the Nasa Standard Initiators (NSIs) via the Pyro 
Initiator Controllers (PICs) to initiate operation of the 
pyrotechnic devices. The pyrotechnics interface 
mechanically with the NLG and MLG Uplock Release Mechanisms 
to provide backup to the Hydraulic Deployment System and to 
provide assist to the NLG to initiate Nose Gear/Door 
movement against opposing air loads. 

2. The Orbiter/ET Separation Pyrotechnics interface with the 
Electrical Power Distribution and Control (EPD&C) Subsystem 
at the Nasa Standard Initiators (NSIs) via the Pyro 
Initiator Controllers (PICs) to initiate operation of the 
pyrotechnic devices to effect Orbiter/ET separation upon 
command. The pyrotechnics interface at one fwd and two aft 
attach points that structurally attach the elements and also 
at the L02 and LH2 umbilical plates. 

3. The RMS Guillotine and Jettision Pyrotechnics interface with 
the Electrical Power Distribution and Control (EPD&C) 
Subsystem at the Nasa Standard Initiators (NSIs) via the 
Pyro Initiator Controllers (PICs) to initiate operation of 
the pyrotechnic devices to sever the electrical cable and 
release the manipulator arm and arm support bracket if 
required. The pyrotechnics interface physically with the 
RMS at the base and at the three Manipulator Positioning 
Mechanisms (MPMs) . 

4. The RR Antenna Guillotine and Release Pyrotechnics interface 
with the Electrical Power Distribution and Control (EPD&C) 
Subsystem at the Nasa Standard Initiators (NSIs) via the 
Pyro Initiator Controllers (PICs) to initiate operation of 
the pyrotechnic devices to sever the electrical cable and 
effect non-propul si ve emergency release of the RR Antenna. 
The pyrotechnics interface mechanicallly with the RR Antenna 
at the antenna structural attach point. 
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3.2 Interfaces and Locations (cont'd) 

5. The Crew Station and Equipment Pyrotechnics interface with a 
T-handle in the crew compartment and another on the exterior 
right hand side, either of which can be used to fire a 
mechanical initiator to blow away the outer panel and open 
the inner window panel for emergency crew egress. A stowed 
prybar is provided to force open the inner window if 
required. 

3 . 3 Hierarchy 

Figure 2 illustrates the hierarchy of the Pyrotechnics hardware 
and the corresponding subcomponents. Figures 3 through 9 
comprise the detailed system representation. 
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PYROTECHNIC SUBSYSTEM OVERVIEW 


LANDING/DECELERATION EPDAC LANDING/DECELERATION 
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WINDOW 

• OPEN INNER 
WINDOW 
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T HANDLE 
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— COMPARTMENT 

• EXTERIOR 
RH SIDE 


Figure 2 - PYROTECHNIC SUBSYSTEM OVERVIEW 
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NASA Standard Detonator (NSD) 



Figur* 3 - NASA STANDARD DETONATOR (NSD) 
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NASA Standard Initiator (NSI) 



Figure 4 - NASA STANDARD INITIATOR (NSI) 
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Figure 5 - ORBITER ET SEPARATION 
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Figure 6 - LANDING GEAR CONTROL SYSTEM OVERVIEW 
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Figure 7 - REMOTE MANIPULATOR 8YSTEM (RM8) WIRE BUNDLE 
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Figure 8 - RMS RETRACTOR 
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Antenna 



Figure 9 - RENDEZVOUS RADAR ANTENNA SEPARATION 
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4 . 0 ANALYSIS RESULTS 

Detailed analysis results for each of the identified failure 
modes are presented in Appendix C. Table I presents a summary of 
the failure criticalities for each of the five major subdivisions 
of the Orbiter Pyrotechnics. Further discussion of each of these 
subdivisions and the applicable failure modes is provided in 
subsequent paragraphs. 


+ 

I TABLE I Summary of IOA Failure Modes and Criticalities | 


Criticality: 

1/1 

2/1R 

2/2 

3/1R 

3/2R 

3/3 

TOTAL 

Landing Sys 

7 

2 

0 

0 

0 

0 

9 

Orb/ET Sep 

9 

3 

0 

0 

0 

0 

12 

RR Ant Rel 

4 

2 

2 

0 

0 

0 

8 

P/L Retn/Depl 

5 

0 

1 

0 

0 

0 

6 

Crew Sta Eq 

2 

4 

0 

0 

0 

0 

6 

TOTAL 

27 

11 

3 

0 

0 

0 

41 


Of the 41 failure modes analyzed, 38 failures were determined to 
result in loss of crew or vehicle, and 3 were determined to 
result in loss of mission. A summary of the potential critical 
items is presented in Table II. Appendix D presents a cross 
reference between each potential critical item (PCI) and a 
specific worksheet in Appendix C. 




j TABLE II Summary of IOA Potential Critical Items I 


Criticality: 

1/1 

2/1R 

2/2 

3/1R 

3/2R 

TOTAL 

TOTAL: 

27 

11 

3 

0 

0 

41 
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4.1 Analysis Results - Landing/Deceleration System 

Pyrotechnics 

The Orbiter Landing/Deceleration System uses pyrotechnics in 
the Nose Landing Gear for uplock release as backup to the 
hydraulic system and as assist (every mission whether needed or 
not) for nose gear extension. Pyrotechnics are used in the 
Main Landing Gear for uplock release as backup to the hydraulic 
system. The backup functions are initiated one second after the 
down Push Button Indicator (PBI) is activated if the hydraulic 
system has failed to lower the landing gear. There are nine (9) 
pyrotechnic failure modes identified for this system. Of these, 
seven (7) are Criticality 1/1 and two (2) are Criticality 2/1R. 


4.2 Analysis Results - Orbiter/ET Separation Mechanisms 

Pyrotechnics 

The Orbiter/ET Separation Mechanisms employs Pyrotechnics as the 
prime method of separation of the two elements. The Orbiter is 
separated at the fwd attach point by a pyrotechnic separation 
bolt that includes a single piston and dual pressure cartridges 
that are fired to shear the attach bolt. The two aft attach 
points are separated by fracture of its respective single 
frangible nut. Each frangible nut has two booster cartridges and 
two detonator cartridges either of which is adequate to fracture 
the nut. The two umbilical plates are each disconnected by means 
of three frangible nuts with each nut having two detonator 
cartridges. There are twelve (12) pyrotechnic failure modes 
identified for this system. Of these, nine (9) are Criticality 
1/1 and three (3) are Criticality 2/1R. 


4.3 Analysis Results - Rendezvous Radar (RR) Antenna Release 

Pyrotechnics 

The Rendezvous Radar Antenna can be jettisoned to permit payload 
bay door closure if the normal stowage mechanism fails. The 
pyrotechnic sustem releases the structural attachment and severs 
the umbilical. The guillotine and release nut e ac h have dual 
pressure cartridges such that successful firing of one of the 
cartridges is adequate to cause the device to function. There 
are eight (8) pyrotechnic failure modes identified for this 
system. Of these, four (4) are Criticality 1/1; two (2) are 
Criticality 2/1R; and two (2) are Criticality 2/2. 
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4.4 Analysis Results - Payload Retention and Deploy Jettison 

Pyrotechnics 

The Remote Manipulator System (RMS) Pyrotechnics are emergency 
separation devices that consist of four separate subsystems that 
release the Remote Manipulator Arm and the three Manipulator 
Positioning/Retention Mechanisms (MPMs) . The guillotine with the 
dual pressure cartridges and one of the retractors is located on 
the sill longeron, at the base of the RMS. Their purpose is to 
sever the RMS electrical wire bundle and release the RMS 
mechanically. The remaining three guillotine devices and 
retractors are mounted on the three MPMs. Their purpose is to 
sever the control cable to the Manipulator Retention Latch (MRL) 
and to mechanically release the MPM at the designated separation 
plane to allow closure of the Payload Bay Doors (PLBDs) . There 
are six (6) pyrotechnic FMEAs indentified for this system. Of 
these, five are criticality 1/1 and one (1) is criticality 2/2. 


4.5 Analysis Results - Crew Station Emergency Egress System 

Pyrotechnics 

Crew Station and Equipment Emergency Egress System Pyrotechnics 
are employed to break the attach bolts to sever the outer window 
and to open the inner window. Window severence can be initiated 
from either the interior of the crew compartment or the exterior 
right hand side for ground crew use. The system would only be 
utilized if a failure occurs that requires crew egress and the 
entry door is jammed. There are six pyrotechnic FMEAs identified 
for this system. Of these, two (2) are criticality 1/1 and four 
(4) are criticality 2/1R. 
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MLG 

MPM 

MRL 


ACRONYNS and ABBREVIATIONS 


- Alternating Current 

- Abort Once Around 

- Antenna 

- Abort To Orbit 

- Backup Flight Software 

- Critical Items List 

- Circuit 

- Continued 

- Current 

- Deploy 

- Direct Current 

- Electrical Power Distribution and Control 

- Equipment 

- External Tank 

- Functional 

- Forward Motor Controller 

- Failure Mode Effects Analysis 

- Forward Power Controller 

- Functional 

- Forward 

- Guillotine 

- Hermetically 

- Hardware 

- Hertz (cycles per second) 

- Independent Orbiter Analysis 

- Jettison 

- Liquid Hydrogen 

- Limiting 

- Liquid Oxygen 

- McDonnell Douglas Astronautics Company 

- Multiplexer/Demultiplexer 

- Main Landing Gear 

- Manipulator Positioning Mechanixm 

- Manipulator Retention Mechanism 
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ACRONYMS and ABBREVIATIONS (Cont'd) 


NA 

NASA 
NLG 
NS I 
NSP 
NSTS 

OAO 

Orb 

P 

PASS 

PBM 

PCI 

PIC 

P/L 

PLBD 

Pos 

Pyro 

Rel 

Retn 

RMS 

RR 

RTLS 

Sep 

Sta 

STS 

Sys 

TAL 


- Not applicable 

- National Aeronautics and Space Administration 

- Nose Landing Gear 

- NASA Standard Initiator 

- NASA Standard Detonator 

- National Space Transportation System 

- Once-Around-Abort 

- Orbiter 

- Pass 

- Primary Avionics Systems Software 

- Payload Bay Mechanical 

- Potential Critical Item 

- Pyro Initiator Controller 

- Payload 

- Payload Bay Door 

- Position 

- Pyrotechnic 

- Release 

- Retention 

- Remote Manipulator System 

- Rendezvous Radar 

- Return-To-Launch-Site 

- Separation 

- Station 

- Space Transportation System 

- System 

- Trans-Atlantic-Landing (Abort Landing) 


A-2 



APPENDIX B 


DEFINITIONS , GROUND RULES , AND ASSUMPTIONS 


B.l Definitions 

B.2 Project Level Ground Rules and Assumptions 
B.3 Subsystem-Specific Ground Rules and Assumptions 



APPENDIX B 

DEFINITIONS , GROUND RULES , AND ASSUMPTIONS 


B.l Definitions 


Definitions contained in NSTS 22206. Instructions For Preparation 
of FMEA/CIL. 10 October 1986 , were used with the following 
amplifications and additions. 

INTACT ABORT DEFINITIONS; 


RTLS - begins at transition to OPS 6 and ends at transition 
to OPS 9, post-flight 


TAL - begins at declaration of the abort and ends at 
transition to OPS 9, post-flight 

AOA - begins at declaration of the abort and ends at 
transition to OPS 9, post-flight 


ATO - begins at declaration of the abort and ends at 
transition to OPS 9, post-flight 

p'P'rdtrt.'F! f CAUSED - an event that can be predicted or expected in 
anticipated operational environmental conditions. Excludes an 
event where multiple failures must first occur to result in 
environmental extremes 


CONTINGENCY CREW PROCEDURES - procedures that are utilized beyond 
the standard malfunction procedures, pocket checklists, and cue 
cards 


early MISSION TERMINATION - termination of onorbit phase prior to 
planned end of mission 

EFFECTS /rationale - description of the case which generated the 
highest criticality 

HIGHEST CRITICALITY - the highest functional criticality 
determined in the phase-by-phase analysis 

MAJOR MODE CMM^ - major sub-mode of software operational sequence 
(OPS) 

MC - Memory Configuration of Primary Avionics Software System 
(PASS) 

MISSION - assigned performance of a specific Orbiter flight with 
payload/objective accomplishments including orbit phasing and 
altitude (excludes secondary payloads such as GAS cans, 
middeck P/L, etc.) 
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multiple ORDER FAILURE - describes the failure due to a single 
cause or event of all units which perform a necessary (critical) 
function 

OFF-NOMINAL CREW PROCEDURES - procedures that are utilized beyond 
the standard malfunction procedures, pocket checklists, and cue 
cards 

OPS - software operational sequence 

PRIMARY MISSION OBJECTIVES - worst case primary mission objec- 
tives are equal to mission objectives 

PHASE DEFINITIONS: 

PRELAUNCH PHASE - begins at launch count-down Orbiter 
power-up and ends at moding to OPS Major Mode 102 (liftoff) 

LIFTOFF MISSION PHASE - begins at SRB ignition (MM 102) and 
ends at transition out of OPS 1 (Synonymous with ASCENT) 

ONORBIT PHASE - begins at transition to OPS 2 or OPS 8 and 
ends at transition out of OPS 2 or OPS 8 

DEORBIT PHASE - begins at transition to OPS Major Mode 
301 and ends at first main landing gear touchdown 

LANDING/SAFING PHASE - begins at first main gear 
touchdown and ends with the completion of post-landing 
safing operations 
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APPENDIX B 

DEFINITIONS , GROUND RULES , AND ASSUMPTIONS 


B. 2 IOA Project Level Ground Rules and Assumptions 

The philosophy embodied in NSTS 22206, Instructions for 
Preparation of FMEA/CIL. 10 October 1986 , was employed with the 
following amplifications and additions. 


1. The operational flight software is an accurate 
implementation of the Flight System Software Requirements 
(FSSRs) . 

RATIONALE: Software verification is out-of-scope of 
this task. 

2. After liftoff, any parameter which is monitored by system 
management (SM) or which drives any part of the Caution and 
Warning System (C&W) will support passage of Redundancy 
Screen B for its corresponding hardware item. 

RATIONALE: Analysis of on-board parameter availability 
and/or the actual monitoring by the crew 
is beyond the scope of this task. 

3. Any data employed with flight software is assumed to be 
functional for the specific vehicle and specific mission 
being flown. 

RATIONALE: Mission data verification is out-of-scope of 
this task. 

4. All hardware (including firmware) is manufactured and 
assembled to the design specifications/drawings. 

RATIONALE: Acceptance and verification testing is 

designed to detect and identify problems 
before the item is approved for use. 

5. All Flight Data File crew procedures will be assumed 
performed as written, and will not include human error in 
their performance. 

RATIONALE: Failures caused by human operational error 
are out-of-scope of this task. 
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6 . 


All hardware analyses will, as a minimum, be performed at 
the level of analysis existent within NASA/Prime Contractor 
Orbiter FMEA/CILs, and will be permitted to go to greater 
hardware detail levels but not lesser. 

RATIONALE: Comparison of IOA analysis results with 

other analyses requires that both analyses 
be performed to a comparable level of 
detail . 

7. Verification that a telemetry parameter is actually 
monitored during AOS by ground-based personnel is not 
required. 

RATIONALE: Analysis of mission-dependent telemetry 

availability and/or the actual monitoring of 
applicable data by ground-based personnel is 
beyond the scope of this task. 

8. The determination of criticalities per phase is based on the 
worst case effect of a failure for the phase being analyzed. 
The failure can occur in the phase being analyzed or in 

any previous phase, whichever produces the worst case 
effects for the phase of interest. 

RATIONALE: Assigning phase criticalities ensures a 
thorough and complete analysis. 

9. Analysis of wire harnesses, cables, and electrical connectors 
to determine if FMEAs are warranted will not be performed 
nor FMEAs assessed. 

RATIONALE: Analysis was substantially complete prior 

to NSTS 22206 ground rule redirection. 

10. Analysis of welds or brazed joints that cannot be inspected 
will not be performed nor FMEAs assessed. 

RATIONALE: Analysis was substantially complete prior 

to NSTS 22206 ground rule redirection. 

11. Emergency system or hardware will include burst discs and 
will exclude the EMU Secondary Oxygen Pack (SOP) , pressure 
relief valves and the landing gear pyrotechnics. 

RATIONALE: Clarify definition of emergency systems to 
ensure consistency throughout IOA project. 
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APPENDIX B 

DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 


B.3 Pyrotechnics-Specific Ground Rules and Assumptions 

The IOA analysis was performed to the component or assembly level 
of the Pyrotechnic devices in the Orbiter Landing Systems, 
Orbiter/ET Separation System, RMS Guillotine and Jettison System, 
Rendezvous Radar Release System, and the Ground Emergency Egress 
System. The analysis considered the worst case effects of the 
hardware or functional failure on the subsystem, mission, and 
crew and vehicle safety. 

1. Component age life was not considered in the analysis. 

RATIONALE: Component age analysis is beyond the scope 

of this task. 


2. Criticality of emergency system failure modes were 
established on the basis of the effect of the first 
failure of the emergency system on the crew or vehicle. 

RATIONALE: Regardless of the number of failures that 

would have to occur before the emergency 
system would be required, its purpose is 
to accomplish its intended task without 
fail under emergency conditions. Emergency 
systems are not employed unless there is 
an emergency condition in existence. 


3. Criticality of backup system pyrotechnic failures were 
established with the same approach as emergency systems. 

RATIONALE: The backup pyrotechnics involved in this 

analysis are employed only (albeit 
automatically) after failure of the 
primary system, as in the Landing 
Gear deployment, therefore all previous 
failures are discounted in the Criticality 
assignments. 

4 . Premature or inadvertent operation of pyrotechnic 
devices is considered to be the highest criticality. 

RATIONALE: Uncommanded operation by a pyrotechnic 

device would be catastrophic particularly 
when involved in separation of Shuttle 
elements and premature deployment of 
landing gear. Premature operation of 
emergency or backup pyrotechnics could 
likewise cause unpredictable results. 
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5. Failure inodes were limited to failure of the component 
or assembly to function as intended and inadvertent 
or premature uncommanded operation. 

RATIONALE: Whether the cause of the failure of a 

pyrotechnic device to function as intended 
to accomplish an action be a failure to 
fire, fire with insufficient force, or low 
pressure output, the result would be 
essentially the same. Failures of other 
systems that cause inadvertent operation 
of the pyrotechnic devices covered in this 
analysis are not considered a failure of 
the pyrotechnic device itself. If a 
switch fails and causes a command to be 
issued to fire a pyrotechnic device, the 
failure lies with the switch. 
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APPENDIX C 
DETAILED ANALYSIS 

This section contains the IOA analysis worksheets employed during 
the analysis of the Pyrotechnics subsystem. The information on 
these worksheets is intentionally similar to the FMEA's written 
by Rockwell and the NASA. Each of these sheets identifies the 
item being analyzed, and parent assembly, as well as the 
function. For each failure mode, the possible causes are 
outlined, and the assessed hardware and functional criticality 
for each mission phase is listed, as described in the Rockwell 
Desk Instructions 100-2G . Finally, effects are entered at the 
bottom of each sheet, and the worst case criticality is entered 
at the top. 


LEGEND FOR IOA ANALYSIS WORKSHEETS 


Hardware Criticalities : 

1 = Loss of life or vehicle 

2 = Loss of mission 

3 = Non loss of life or vehicle or mission 
Functional Criticalities : 

1R = Redundant identical hardware components or redundant 
functional paths all of which, if failed, could cause 
loss of life or vehicle. 

2R = Redundant identical hardware components or redundant 
functional paths all of which, if failed, could cause 
loss of mission. 

Redundancy Screen A : 

1 * Is Checked Out PreFlight 

2 * Is Capable of Check Out PreFlight 

3 * Not Capable of Check Out PreFlight 

4 = Do Not Know 


Redundancy Screens B and C : 
P - Passed Screen 
F * Failed Screen 
NA = Not Applicable 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 11/23/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4601 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: THRUSTER ASSY 

FAILURE MODE: FAILS TO OPERATE 

LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 

BREAKDOWN HIERARCHY: 

1) LANDING/DECELERATION SYSTEMS 

2) MAIN LANDING GEAR 

3) PYRO UPLOCK RELEASE THRUSTER ' 

4 ) THRUSTER ASSY 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

/NA 

RTLS: 

1/1 

LIFTOFF: 

/NA 

TAL: 

1/1 

ONORBIT: 

/NA 

AOA: 

/NA 

DEORBIT: 

LANDING/SAFING 

1/1 

: /NA 

ATO: 

/NA 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: 

PART NUMBER: MC325-0019-0001 , SKD26100102-201 


CAUSES: MECHANICAL/STRUCTURAL MALFUNCTION, CORROSION, 

CONTAMINATION, CHEMICAL DETERIORATION. 

EFFECTS/RATIONALE : 

FAILURE TO EXTEND ONE MAIN LANDING GEAR DURING LANDING (INCLUDING 
ABORT LANDING SITUATIONS) WOULD CAUSE LOSS OF VEHICLE/ CREW. 

THE INITIATORS ARE REDUNDANT THEREFORE NORMAL OPERATION OF EITHER 
SHOULD EFFECT NORMAL OPERATION OF THE RELEASE ASSEMBLY TO EXTEND 
THE MAIN LANDING GEAR. 

REFER ALSO TO IOA FMEA 21102. 


REFERENCES: MC325-0019 


REPORT DATE 01/05/88 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 11/23/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4602 

ITEM: PRESSURE CARTRIDGE 


FAILURE MODE: FAILS TO OPERATE 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 


BREAKDOWN HIERARCHY: 

1) LANDING/DECELERATION SYSTEMS 

2) MAIN LANDING GEAR 

3) PYRO UPLOCK RELEASE THRUSTER ASSY 

4) PRESSURE CARTRIDGE 

5) (SINGLE CARTRIDGE - DUAL INITIATORS) 

6 ) 

7 ) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

/NA 

RTLS: 

1/1 

LIFTOFF: 

/NA 

TAL: 

1/1 

ONORBIT : 

/NA 

AOA: 

/NA 

DEORBIT : 
LANDING/SAFING : 

1/1 

/NA 

ATO: 

/NA 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: 

PART NUMBER: MC325-0019-0002 , SKD26100102-301 


CAUSES: MECHANICAL/STRUCTURAL MALFUNCTION, CORROSION, 

CONTAMINATION, CHEMICAL DETERIORATION. 

EFFECTS/RATIONALE : 

FAILURE TO EXTEND ONE MAIN LANDING GEAR DURING LANDING (INCLUDING 
ABORT LANDING SITUATIONS) WOULD CAUSE LOSS OF VEHICLE/ CREW. 

THE INITIATORS ARE REDUNDANT THEREFORE NORMAL OPERATION OF EITHER 
SHOULD EFFECT NORMAL OPERATION OF THE RELEASE ASSEMBLY TO EXTEND 
THE MAIN LANDING GEAR. 

REFER ALSO TO IOA FMEA 21102- 


REFERENCES: MC325-0019 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 11/23/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4603 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: PRESSURE CARTRIDGE 

FAILURE MODE: INADVERTENT OPERATION 


LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 

BREAKDOWN HIERARCHY: 

1) LANDING/DECELERATION SYSTEMS 

2) MAIN LANDING GEAR 

3) PYRO UPLOCK RELEASE THRUSTER ASSY 

4 ) PRESSURE CARTRIDGE 

5) (SINGLE CARTRIDGE - DUAL INITIATORS) 

6 ) 

7) 

8) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

2/2 

RTLS : 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT : 

1/1 

AO A: 

1/1 

DEORBIT: 

1/1 

ATO: 

1/1 

LANDING/SAFING 

: /NA 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: 

PART NUMBER: MC325-0019-0002 , SKD26100102-301 

CAUSES: HIGH TEMPERATURE ENVIRONMENT, MECHANICAL/ STRUCTURAL 

MALFUNCTION, SHOCK, CORROSION, CONTAMINATION, CHEMICAL 
DETERIORATION. 

EFFECTS/RATIONALE : 

PREMATURE EXTENTION OF MAIN LANDING GEAR COULD POSSIBLY CAUSE 
LOSS OF VEHICLE/CREW DURING ASCENT, ABORT AND DEORBIT. COULD 
CAUSE LOSS OF VEHICLE AND POSSIBLY LOSS OF CREW ON-ORBIT IF 
RESCUE WERE NOT POSSIBLE. 

INADVERTENT FIRING OF EITHER OF THE DUAL INITIATORS WOULD SUFFICE 
TO OPERATE THE PYRO UPLOCK RELEASE ASSY THEREFORE CRIT 1 IS 
APPLICABLE. 

REFER ALSO TO IOA FMEA 21101. 

REFERENCES: MC325-0019 


REPORT DATE 01/05/88 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 11/23/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4604 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: THRUSTER ASSY 

FAILURE MODE: FAILS TO OPERATE 


LEAD ANALYST: W. W. ROBINSON 


SUBSYS LEAD: ROBINSON 


BREAKDOWN HIERARCHY: 

1) LANDING/DECELERATION SYSTEMS 

2) NOSE WHEEL GEAR 

3) PYRO UPLOCK RELEASE THRUSTER ASSY 

4) THRUSTER ASSY 

5 ) 

6 ) 

7 ) 

8 ) 

9 ) 


FLIGHT PHASE 
PRELAUNCH : 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/SAFING: 


CRITICALITIES 
HDW/FUNC ABORT 


/NA 

/NA 

/NA 

2/1R 

/NA 


RTLS : 
TAL: 
AO A: 
ATO: 


HDW/FUNC 

2/1R 

2/1R 

/NA 

/NA 


REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 

LOCATION: 

PART NUMBER: MC325-0006-0001 , SKD26100101-201 

CAUSES : MECHANICAL/ STRUCTURAL MALFUNCTION , CORROSION , 

CONTAMINATION, CHEMICAL DETERIORATION. 


EFFECTS/RATIONALE : 

FAILURE TO EXTEND THE NOSE WHEEL GEAR DURING LANDING (INCLUDING 
ABORT LANDING SITUATIONS) WOULD CAUSE LOSS OF VEHICLE/ CREW. 

THE INITIATORS ARE REDUNDANT THEREFORE NORMAL OPERATION OF EITHER 
SHOULD EFFECT NORMAL OPERATION OF THE RELEASE ASSEMBLY TO EXTEND 
THE NOSE WHEEL GEAR. 

REFER ALSO TO IOA FMEA 11102. 


REFERENCES: MC325-0006, V070-51550 


REPORT DATE 01/05/88 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 11/23/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4605 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM; PRESSURE CARTRIDGE 

FAILURE MODE: FAILS TO OPERATE 

LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 

BREAKDOWN HIERARCHY: 

1) LANDING/DECELERATION SYSTEMS 

2) NOSE WHEEL GEAR 

3) PYRO UPLOCK RELEASE THRUSTER ASSY 
' 4) PRESSURE CARTRIDGE 

5) (SINGLE CARTRIDGE) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 


PRE LAUNCH: 

/NA 

RTLS : 

2/1R 

— 

LIFTOFF: 

/NA 

TAL: 

2/1R 

m 

ONORBIT: 

/NA 

AOA: 

/NA 


DEORBIT: 

2/1R 

ATO: 

/NA 


LANDING/SAFING 

: /NA 



m 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 



LOCATION : 

PART NUMBER: MC325-0006-0001, SKD26100101-301 


CAUSES: MECHANICAL/ STRUCTURAL MALFUNCTION, CORROSION, 

CONTAMINATION, CHEMICAL DETERIORATION. 

EFFECTS/RATIONALE : 

FAILURE TO EXTEND THE NOSE WHEEL GEAR DURING LANDING (INCLUDING 
ABORT LANDING SITUATIONS) WOULD CAUSE LOSS OF VEHICLE/ CREW. 

THE I NITIATORS ARE REDUNDANT THEREF ORE NORMAL OPERATION OF EITHER 
SHOULD EFFECT NORMAL OPERATION OF THE RELEASE ASSEMBLY TO EXTEND 
THE NOSE WHEEL GEAR. 

REFER ALSO TO IOA FMEA 11102. 

REFERENCES: MC325-0006, V070-51550 


REPORT DATE 01/05/88 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 11/23/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4606 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: PRESSURE CARTRIDGE 

FAILURE MODE: FIRES INADVERTENTLY 


LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 


BREAKDOWN HIERARCHY: 

1) LANDING/DECELERATION SYSTEMS 

2) NOSE WHEEL GEAR 

3) PYRO UPLOCK RELEASE THRUSTER ASSY 

4) PRESSURE CARTRIDGE 

5) (SINGLE CARTRIDGE) 

6 ) 

7 ) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

2/2 

RTLS: 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT : 

1/1 

AOA: 

/NA 

DEORBIT : 
LANDING/SAFING: 

1/1 

/NA 

ATO: 

/NA 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: 

PART NUMBER: MC325-0006-0001 , SKD26100101-301 

CAUSES: HIGH TEMPERATURE ENVIRONMENT, MECHANICAL/ STRUCTURAL 

MALFUNCTION, SHOCK, CORROSION, CONTAMINATION, CHEMICAL 
DETERIORATION. 

EFFECTS/RATIONALE : 

PREMATURE EXTENT I ON OF NOSE WHEEL GEAR COULD POSSIBLY CAUSE LOSS 
OF VEHICLE/ CREW DURING ASCENT, ABORT AND DEORBIT. COULD CAUSE 
LOSS OF VEHICLE AND POSSIBLY LOSS OF CREW ON-ORBIT IF RESCUE WERE 
NOT POSSIBLE. 

INADVERTENT FIRING OF EITHER OF THE DUAL INITIATORS WOULD SUFFICE 
TO OPERATE THE THRUSTER ASSY OF THE NOSE WHEEL GEAR PYRO UPLOCK 
RELEASE ASSY THEREFORE CRIT 1 IS APPLICABLE. 

REFER ALSO TO IOA FMEA 11101. 

REFERENCES: MC325-0006, V070-510550, V070-552002 


REPORT DATE 01/05/88 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

11 / 23/87 

HIGHEST CRITICALITY 

HDW/FUNC 

SUBSYSTEM: 

PYROTECHNICS 

FLIGHT: 

1/1 

MDAC ID: 

4607 

ABORT: 

1/1 

ITEM: 

THRUSTER ASSY 



FAILURE MODE 

: FAIL TO OPERATE 



LEAD ANALYST 

: W. W. ROBINSON 

SUBSYS LEAD: ROBINSON 



BREAKDOWN HIERARCHY: 

1) LANDING/DECELERATION SYSTEMS 

2) NOSE WHEEL GEAR 

3) PYRO GEAR EXTENSION ASSIST THRUSTER ASSY 

4) THRUSTER ASSY 

5 ) 

6 ) 

7 ) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

/NA 

RTLS: 

1/1 

LIFTOFF: 

/NA 

TAL: 

1/1 

ONORBIT : 

/NA 

AO A: 

/NA 

DEORBIT: 

1/1 

ATO: 

/NA 

LANDING/SAFING: 

/NA 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION : 

PART NUMBER: MC325-0006-0001, SKD26100100-205 

CAUSES: MECHANICAL/STRUCTURAL MALFUNCTION, CORROSION, 

CONTAMINATION, CHEMICAL DETERIORATION. 


EFFECTS /RATIONALE : 

FAILURE TO EXTEND THE NOSE WHEEL GEAR IN TIME DURING LANDING 
(INCLUDING ABORT LANDING SITUATIONS) WOULD CAUSE LOSS OF 
VEHICLE/ CREW. 

THE INITIATORS ARE REDUNDANT THEREFORE NORMAL OPERATION OF EITHER 
INITIATOR SHOULD EFFECT NORMAL OPERATION OF THE GEAR EXTENSION 
ASSIST TO EXTEND THE NOSE WHEEL GEAR. 

REFER ALSO TO IOA FMEA 11202, 

REFERENCES: MC325-0006 


REPORT DATE 01/05/88 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

11/23/87 

HIGHEST CRITICALITY 

HDW/FUNC 

SUBSYSTEM: 

PYROTECHNICS 

FLIGHT : 

1/1 

MDAC ID: 

4608 

ABORT: 

1/1 

ITEM: 

PRESSURE CARTRIDGE 



FAILURE MODE 

: FAIL TO OPERATE 



LEAD ANALYST 

: W. W. ROBINSON 

SUBSYS LEAD: ROBINSON 



BREAKDOWN HIERARCHY: 

1) LANDING/ DECELERATION SYSTEMS 

2) NOSE WHEEL GEAR 

3) PYRO GEAR EXTENSION ASSIST THRUSTER ASSY 

4) PRESSURE CARTRIDGE 

5) (SINGLE CARTRIDGE) 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH : 

/NA 

RTLS: 

1/1 

LIFTOFF: 

/NA 

TAL: 

1/1 

ONORBIT: 

/NA 

AOA: 

/NA 

DEORBIT : 

1/1 

ATO: 

/NA 

LANDING/SAFING: 

/NA 




REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 

LOCATION: 

PART NUMBER: MC325-0006-0001 , SKD26100101-201 


CAUSES : MECHANICAL/STRUCTURAL MALFUNCTION, CORROSION , 

CONTAMINATION, CHEMICAL DETERIORATION. 


EFFECTS /RATIONALE : 

FAILURE TO EXTEND THE NOSE WHEEL GEAR IN TIME DURING LANDING 
(INCLUDING ABORT LANDING SITUATIONS) WOULD CAUSE LOSS OF 
VEHICLE/ CREW. 

THE INITIATORS ARE REDUNDANT THEREFORE NORMAL OPERATION OF EITHER 
INITIATOR SHOULD EFFECT NORMAL OPERATION OF THE GEAR EXTENSION 
ASSIST TO EXTEND THE NOSE WHEEL GEAR. 

REFER ALSO TO IOA FMEA 11202. 


REFERENCES: MC 325-0006 


REPORT DATE 01/05/88 


C-9 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

11/23/87 

HIGHEST CRITICALITY 

HDW/FUNC 

SUBSYSTEM: 

PYROTECHNICS 

FLIGHT: 

1/1 

MDAC ID: 

4609 

ABORT: 

1/1 

ITEM: 

FAILURE MODE 

PRESSURE CARTRIDGE 
: FIRES INADVERTENTLY 



LEAD ANALYST 

: W. W. ROBINSON 

SUBSYS LEAD: ROBINSON 



BREAKDOWN HIERARCHY: 

1) LANDING/DECELERATION SYSTEMS 

2) NOSE WHEEL GEAR 

3) PYRO GEAR EXTENSION ASSIST THRUSTER ASSY 

4) PRESSURE CARTRIDGE 

5) (SINGLE CARTRIDGE) 

6 ) 

7) 

8 ) 

9) 


FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/SAFING: 


CRITICALITIES 


HDW/FUNC 

2/2 

1/1 

1/1 

1/1 

/NA 


ABORT 
RTLS : 
TAL: 
AOA: 
ATO: 


HDW/FUNC 

1/1 

1/1 

/NA 

/NA 


REDUNDANCY SCREENS: A [NA ] B [NA ] 


C [NA ] 


LOCATION : 

PART NUMBER: MC325-0006-0001 , SKD26100101-201 

CAUSES: HIGH TEMPERATURE ENVIRONMENT, MECHANICAL/STRUCTURAL 

MALFUNCTION, SHOCK, CORROSION, CONTAMINATION, CHEMICAL 
DETERIORATION. 

EFFECTS/RATIONALE : 

PREM ATURE EXT ENTION OF M AIN LANDING GEAR COULD P OSSIB LY CAUSE 
LOSS OF VEHICLE/CREW DURING ASCENT . ABO RT AND DEORBJT. COULD . 
CAUSE LOSS OF VEHICLE AND POSSIBLY LOSS OF CREW ON-ORBIT IF 
RESCUE WERE NOT POSSIBLE. 

INADVERTENT FIRING OF EITHER OF THE DUAL INITIATORS WOULD SUFFICE 
TO OPERATE THE THRUSTER ASSY OF THE PYRO-GEAR EXTENSION ASSIST 
THEREFORE CRIT 1 IS APPLICABLE. 

REFER ALSO TO IOA FMEA 11201. 

REFERENCES: MC325-0006 


REPORT DATE 01/05/88 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 11/23/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4651 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: » 1/1 

ABORT: 1/1 


ITEM: SHEAR BOLT 

FAILURE MODE: PREMATURE BOLT FRACTURE 


LEAD ANALYST: W. W. ROBINSON 


SUBSYS LEAD: ROBINSON 


BREAKDOWN HIERARCHY: 

1) ORBITER/ EXTERNAL TANK (ET) SEPARATION MECHANISMS PYROS 

2) FORWARD SEPARATION 

3) SHEAR BOLT 

4) (1 PER SHUTTLE) 

5 ) 

6 ) 

7 ) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

1/1 

RTLS: 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT: 

/NA 

AOA: 

/NA 

DEORBIT : 

/NA 

ATO: 

/NA 

LANDING/SAFING 

: /NA 




REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 

LOCATION: 

PART NUMBER: MC325-0014-0007 , SKD26100098-245 


CAUSES: HIGH TEMPERATURE ENVIRONMENT, MECHANICAL/ STRUCTURAL 

MALFUNCTION, SHOCK, CORROSION, CONTAMINATION, CHEMICAL 
DETERIORATION. 


EFFECTS/RATIONALE : 

PREMATURE FRACTURE OF THE FWD SEPARATION BOLT OR THE MONOBALL 
WOULD SEPARATE THE ORBITER STRUCTURALLY FROM THE ET AT THE FWD 
ATTACH POINT. 

PREMATURE STRUCTURAL SEPARATION OF THE ORBITER AND ET WOULD 
PRODUCE CATASTROPHIC RESULTS FROM UNCONTROLLED FORCES BEING 
APPLIED IN UNCONTROLLED DIRECTIONS WHICH COULD TEAR APART THE 
ORBITER. 


REFERENCES: MC325-0014 


REPORT DATE 01/05/88 


C-ll 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

11/23/87 

HIGHEST CRITICALITY 

HDW/FUNC 

SUBSYSTEM: 

PYROTECHNICS 

• FLIGHT: 

1/1 

MDAC ID: 

4652 

ABORT: 

1/1 

ITEM: 

SHEAR BOLT 



FAILURE MODE 

1: FAIL TO FRACTURE 




LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 


BREAKDOWN HIERARCHY: 

1) ORBITER/EXTERNAL TANK (ET) SEPARATION MECHANISMS PYROS 

2) FORWARD SEPARATION 

3) SHEAR BOLT 

4) (1 PER SHUTTLE) 

5 ) 

6 ) 

7 ) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

/NA 

RTLS : 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT : 

/NA 

AOA: 

/NA 

DEORBIT: 

/NA 

ATO: 

/NA 

LANDING/SAFING 

: /NA 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 

LOCATION: 




PART NUMBER: MC325-0014-0007 , 

SKD26100098-245 



CAUSES: MECHANICAL/STRUCTURAL MALFUNCTION, CORROSION, 

CONTAMINATION, CHEMICAL DETERIORATION. 


EFFECTS/RATIONALE : 

FAILURE OF THE FWD ATTACH BOLT TO FRACTURE UPON SEPARATION 
COMMAND WOULD RESULT IN INABILITY TO SEPARATE THE ORBITER FROM 
THE ET. — •*" 

FAILURE OF ABILITY TO SEPARATE THE ORBITER FROM THE ET WOULD 
RESULT IN LOSS OF VEHICLE/ CREW. 


REFERENCES: MC325-0014 


REPORT DATE 01/05/88 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 11/23/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4653 


HIGHEST CRITICALITY 
FLIGHT : 
ABORT : 


HDW/FUNC 

2/1R 

2/1R 


ITEM: PRESSURE CARTRIDGE 

FAILURE MODE: FAIL TO FUNCTION OR LOW PRESSURE OR REDUCED 

OUTPUT. 


LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 


BREAKDOWN HIERARCHY: 

1) ORBITER/EXTERNAL TANK (ET) SEPARATION MECHANISMS PYROS 

2) FORWARD SEPARATION 

3 ) SHEAR BOLT 

4) PRESSURE CARTRIDGE 

5) (2 PER BOLT) 

6 ) 

7) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

/NA 

RTLS : 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

/NA 

AO A: 

/NA 

DEORBIT: 

LANDING/SAFING: 

/NA 

/NA 

ATO: 

/NA 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: 

PART NUMBER: MC325-0014-0008 , SKD26100098-301 


CAUSES: MECHANICAL/ STRUCTURAL MALFUNCTION, CORROSION, 

CONTAMINATION, CHEMICAL DETERIORATION. 

EFFECTS/RATIONALE : 

FAILURE OF ONE PRESSURE CARTRIDGE WOULD NOT BE DETECTABLE IF THE 
OTHER FUNCTIONED PROPERLY SINCE THEY ARE DUAL REDUNDANT. 

FAILURE OF BOTH REDUNDANT PRESSURE CARTRIDGES WOULD RESULT IN 
INABILITY TO SEPARATE THE ORBITER FROM THE ET. 

LOSS OF ABILITY TO SEPARATE THE ORBITER FROM THE ET WOULD RESULT 
IN LOSS OF CREW/VEHICLE. WHETHER THE FAILURE TO EFFECT PROPER 
SEPARATION IS CAUSED BY THE DETONATOR, PRESSURE CARTRIDGE, OR THE 
BOLT, THE RESULT WOULD BE THE SAME. 

REFERENCES: MC325-0014 


REPORT DATE 01/05/88 


C-13 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 11/23/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4654 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: PRESSURE CARTRIDGE 

FAILURE MODE: INADVERTENT OPERATION 


LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 


BREAKDOWN HIERARCHY : 

1) ORBITER/EXTERNAL TANK (ET) SEPARATION MECHANISMS PYROS 

2) FORWARD SEPARATION 

3 ) SHEAR BOLT 

4) PRESSURE CARTRIDGE 

5) (2 PER BOLT) 

6 ) 

7 ) 

8 ) 

9 ) 


FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/SAFING: 


CRITICALITIES 


HDW/FUNC 

1/1 

1/1 

/NA 

/NA 

/NA 


ABORT 
RTLS : 
TAL: 
AOA: 
ATO: 


HDW/FUNC 

1/1 

1/1 

/NA 

/NA 


REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 

LOCATION: 

PART NUMBER: MC325-0014-0008 , SKD26100098-301 


CAUSES: HIGH TEMPERATURE ENVIRONMENT, MECHANICAL/STRUCTURAL 

MALFUNCTION, SHOCK, CORROSION, CONTAMINATION, CHEMICAL 
DETERIORATION . 


EFFECTS/RATIONALE : 

PREMATURE OPERATION OF EITHER PRESSURE CARTRIDGE WOULD CAUSE 
FRACTURE OF THE FWD SEPARATION BOLT WHICH WOULD SEPARATE THE 
ORBITER STRUCTURALLY FROM THE ET AT THE FWD ATTACH POINT. 
PREMATURE STRUCTURAL SEPARATION OF THE ORBITER AND ET WOULD 
PRODUCE CATASTROPHIC RESULTS FROM UNCONTROLLED FORCES APPLIED IN 
UNCONTROLLED DIRECTIONS WHICH COULD TEAR APART THE ORBITER. 


REFERENCES: MC325-0014 


REPORT DATE 01/05/88 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11/23/87 

PYROTECHNICS 

4655 


HIGHEST CRITICALITY 
FLIGHT : 
ABORT : 


HDW/FUNC 

1/1 

1/1 


ITEM: FRANGIBLE NUT 

FAILURE MODE: PREMATURE FRACTURE 


LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 

BREAKDOWN HIERARCHY • 

1) ORBITER/EXTERNAL TANK (ET) SEPARATION MECHANISMS PYROS 

2) AFT SEPARATION (1 LEFT/1 RIGHT) 

3) FRANGIBLE NUT 

4) (1 LEFT/1 RIGHT) 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 



FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 


PRE LAUNCH: 

1/1 

RTLS: 

1/1 


LIFTOFF: 

1/1 

TAL: 

1/1 


ONORBIT: 

/NA 

AOA: 

/NA 


DEORBIT: 

LANDING/SAFING 

/NA 
: /NA 

ATO: 

/NA 


REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 


LOCATION: 

PART NUMBER: MC114-0018-0007 , SKD26100099-301 


CAUSES: HIGH TEMPERATURE ENVIRONMENT, MECHANICAL/ STRUCTURAL 

MALFUNCTION, SHOCK, CORROSION, CONTAMINATION, CHEMICAL 
DETERIORATION. 

EFFECTS/RATIONALE : 

PREMATURE FRACTURE OF THE FRANGIBLE NUT WOULD THEREBY SEPARATE 
THE ORBITER STRUCTURALLY FROM THE ET AT THAT ATTACH POINT. 
PREMATURE STRUCTURAL SEPARATION OF THE ORBITER AND ET AT AN AFT 
ATTACH POINT WOULD PRODUCE CATASTROPHIC RESULTS FROM UNCONTROLLED 
FORCES BEING APPLIED IN UNCONTROLLED DIRECTIONS WHICH COULD TEAR 
APART THE ORBITER. 

REFER TO IOA FMEA 4652. WHETHER THE FAILURE WERE CAUSED BY 
PREMATURE DETONATION OF A DETONATOR OR STRUCTURAL FAILURE OF THE 
FRANGIBLE NUT, THE RESULTS ARE IDENTICAL. 

REFERENCES: MC114-0018 


REPORT DATE 01/05/88 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

DATE: 11/23/87 HIGHEST CRITICALITY HDW/FUNC 

SUBSYSTEM:* PYROTECHNICS FLIGHT: 1/1 

MDAC ID: 4656 ABORT: 1/1 

ITEM: FRANGIBLE NUT 

FAILURE MODE: FAIL TO FRACTURE UPON RECEIVING SHOCK OUTPUT FROM 

DETONATOR (S) . 

LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 

BREAKDOWN HIERARCHY: 

1) ORBITER/EXTERNAL TANK (ET) SEPARATION MECHANISMS PYROS 

2) AFT SEPARATION (1 LEFT/1 RIGHT) 

3) FRANGIBLE NUT 

4) (1 LEFT/1 RIGHT) 

5) 

6 ) 

7) 

8) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

/NA 

RTLS : 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT : 

/NA 

AOA: 

/NA 

DEORBIT : 

/NA 

ATO: 

/NA 

LANDING/SAFING 

: /NA 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 

LOCATION: 




PART NUMBER: MC114-0018-0007 , 

SKD2 6100099-3 01 



CAUSES: MECHANICAL/STRUCTURAL MALFUNCTION, CORROSION, 

CONTAMINATION, CHEMICAL DETERIORATION. 

EFFECTS/RATIONALE : 

FAILURE OF THE FRANGIBLE NUT TO FRACTURE UPON COMMAND WOULD 
DISALLOW SEPARATION OF THE ET/ORBITER AT THAT AFT ATTACH POINT. 
FAILURE OF AN ATTACH POINT TO DETACH WHEN REQUIRED WOULD PROBABLY 
CAUSE A CATASTROPHIC COLLISION OF THE ET AND ORBITER. 

ABORT LANDING OF THE ORBITER WOULD BE IMPOSSIBLE IF THE ORBITER 
COULD NOT BE SEPARATED FROM THE ET. 

REFERENCES: MC114-0018 


REPORT DATE 01/05/88 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

11/23/87 

HIGHEST CRITICALITY 

HDW/FUNC 

SUBSYSTEM: 

PYROTECHNICS 

FLIGHT: 

2/1R 

MDAC ID: 

4657 

ABORT: 

2/1R 

ITEM: 

FAILURE MODE 

DETONATOR BOOSTER 
: FAILS TO FIRE 

(2) 


LEAD ANALYST 

: W. W. ROBINSON 

SUBSYS LEAD: ROBINSON 



BREAKDOWN HIERARCHY: 

1) ORBITER/EXTERNAL TANK (ET) SEPARATION MECHANISMS PYROS 

2) AFT SEPARATION (1 LEFT/1 RIGHT) 

3 ) FRANGIBLE NUT 

4) DETONATOR/ BOOSTER CARTRIDGE 

5) (2 PER NUT) 

6 ) 

7 ) 

8 ) 

9 ) 

CRITICALITIES 



FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 


PRE LAUNCH: 

/NA 

RTLS: 

2/1R 

mm 

LIFTOFF: 

2/1R 

TAL: 

2/1R 


ONORBIT: 

/NA 

AO A: 

/NA 


DEORBIT: 

/NA 

ATO; 

/NA 

— 

LANDING/ SAFING: 

/NA 




REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: 

PART NUMBER: ME453-0021-0009 , SKD26100099-401 

CAUSES: MECHANICAL/STRUCTURAL MALFUNCTION, CORROSION, 

CONTAMINATION, CHEMICAL DETERIORATION. 

EFFECTS/RATIONALE : 

FAILURE OF ONE DETONATOR TO FIRE WOULD NOT BE DETECTABLE. 

ADEQUATE PERFORMANCE BY EITHER DUAL REDUNDANT DETONATOR WOULD 
SATISFACTORILY PERFORM THE INTENDED FUNCTION TO FRACTURE THE 
FRANGIBLE NUT TO EFFECT ET/ORBITER SEPARATION AT THE AFT ATTACH 
POINTS . 

ANY DUAL FAILURE OF A PAIR OF MATED AFT ATTACH FRANGIBLE NUT 
DETONATORS WOULD CAUSE INABILITY TO SEPARATE THE ORBITER FROM THE 
ET. 

INABILITY TO SEPARATE THE ORBITER FROM THE ET WOULD CAUSE LOSS OF 
VEHICLE/ CREW. 

REFERENCES: MC453-0021 


REPORT DATE 01/05/88 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 11/23/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4658 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT : 


HDW/FUNC 

1/1 

1/1 


ITEM: DETONATOR BOOSTER (2) 

FAILURE MODE: INADVERTENT OPERATION 


LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 

BREAKDOWN HIERARCHY l 

1) ORBITER/EXTERNAL TANK (ET) SEPARATION MECHANISMS PYROS 

2) AFT SEPARATION (1 LEFT/1 RIGHT) 

3 ) FRANGIBLE NUT 

4) DETONATOR/ BOOSTER CARTRIDGE 

5) (2 PER NUT) 

6 ) 

7) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

2/2 

RTLS: 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT : 

/NA 

AOA: 

/NA 

DEORBIT : 

/NA 

ATO: 

/NA 

LANDING/ SAFING 

: /NA 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION : 

PART NUMBER: ME453-0021-0009 , SKD26100099-401 

CAUSES: HIGH TEMPERATURE ENVIRONMENT, MECHANICAL/ STRUCTURAL 

MALFUNCTION, SHOCK, CORROSION, CONTAMINATION, CHEMICAL 
DETERIORATION. 

EFFECTS/RATIONALE : 

PREMATU RE FIRING OF E ITHER OF T HE DUA L REDUNDA NT DETONATORS WOULD 
SUFFICE TO INITIATE THE BOOSTER CHARGE TO FRACTURE THE FRANGIBLE 
NUT AND THEREBY SEPARATE THE ORBITER STRUCTURALLY FROM THE ET AT 
THAT ATTACH POINT. 

PREMATURE STRUCTURAL SEPARATION OF THE ORBITER AND ET WOULD 
PRODUCE CATASTROPHIC RESULTS FROM UNCONTROLLED FORCES BEING 
APPLIED IN UNCONTROLLED DIRECTIONS WHICH COULD TEAR APART THE 
ORBITER. 

REFER TO IOA FMEA 4653. WHETHER THE FAILURE WERE CAUSED BY 
PREMATURE DETONATION OF A DETONATOR OR SIMPLY STRUCTURAL FAILURE 
OF THE FRANGIBLE NUT THE RESULTS ARE IDENTICAL. 

REFERENCES: MC453-0021 


REPORT DATE 01/05/88 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 11/23/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4661 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: FRANGIBLE NUT 

FAILURE MODE: FAIL TO FRACTURE UPON RECEIVING SHOCK INPUT FROM 

DETONATOR (S) . 


LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 

BREAKDOWN HIERARCHY: 

1) ORBITER/EXTERNAL TANK (ET) SEPARATION MECHANISMS PYROS 

2) UMBILICAL PLATE SEPARATION 

3) FRANGIBLE NUT 

4) (3 PER PLATE) 

5 ) 

6 ) 

7 ) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

/NA 

RTLS: 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT: 

/NA 

AOA: 

/NA 

DEORBIT: 

/NA 

ATO: 

/NA 

LANDING/SAFING 

: /NA 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION : 

PART NUMBER: MC114-0018-0003 , SKD26100099-201 


CAUSES: MECHANICAL/STRUCTURAL MALFUNCTION, CORROSION, 

CONTAMINATION, CHEMICAL DETERIORATION. 


EFFECTS/RATIONALE : 

FAILURE OF ANY OF THE THREE FRANGIBLE NUTS ON EITHER THE LEFT OR 
RIGHT SIDE TO FRACTURE UPON COMMAND WOULD PREVENT SEPARATION OF 
THAT ORBITER/ET UMBILICAL PLATE. 

FAILURE TO SUCCESSFULLY EFFECT ORBITER/ET UMBILICAL PLATE 
SEPARATION WOULD PREVENT SAFE ORBITER/ET SEPARATION. 

INABILITY TO SEPARATE THE ORBITER AND ET WOULD CAUSE LOSS OF 
VEHICLE CREW. 


REFERENCES: MC114-0018 


REPORT DATE 01/05/88 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 11/23/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4662 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: FRANGIBLE NUT 

FAILURE MODE: PREMATURE FRACTURE 


LEAD ANALYST: W. W. ROBINSON 


SUBSYS LEAD: ROBINSON 


BREAKDOWN HIERARCHY: 

1) ORBITER/EXTERNAL TANK (ET) SEPARATION MECHANISMS PYROS 

2) UMBILICAL PLATE SEPARATION 

3) FRANGIBLE NUT 

4) (3 PER PLATE) 

5 ) 

6 ) 

7 ) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

1/1 

RTLS: 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT: 

/NA 

AO A: 

/NA 

DEORBIT: 

/NA 

ATO: 

/NA 

LANDING/ SAFING: 

/NA 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: 

PART NUMBER: MC114-0018-0003 , SKD26100099-201 

CAUSES: HIGH TEMPERATURE ENVIRONMENT, MECHANICAL/STRUCTURAL 

MALFUNCTION, SHOCK, CORROSION, CONTAMINATION, CHEMICAL 
DETERIORATION. 


EFFECTS/RATIONALE : 

PREMATU RE FRACTU RE OF ANY ONE OF THE T HREE FR ANGIBLE NUTS COULD 
VIOLATE STRUCTURAL INTEGRITY OF THE ORBITER AND ET UMBILICAL 
PLATES AT 02 AND H2 VALVE SEPARATION PLANE. 

LOSS OF STRUCTURAL INTEGRITY AT THE ORBITER/ET UMBILICAL PLATE 
SEPARATION PLANE COULD RESULT IN PREMATURE SEPARATION WHICH WOULD 
RESULT IN LOSS OF VEHICLE/CREW. — - 


REFERENCES: MC114-0018 


REPORT DATE 01/05/88 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

DATE: 11/23/87 HIGHEST CRITICALITY HDW/FUNC 

SUBSYSTEM: PYROTECHNICS FLIGHT: 2/1R 

MDAC ID: 4663 ABORT: 2/1R 

ITEM: DETONATOR 

FAILURE MODE: FAIL TO FIRE OR REDUCED OUTPUT 

LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 

BREAKDOWN HIERARCHY: 

1) ORBITER/EXTERNAL TANK (ET) SEPARATION MECHANISMS PYROS 

2) UMBILICAL PLATE SEPARATION 

3) FRANGIBLE NUT 

4 ) DETONATOR 

5) (2 PER NUT) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


= = 

FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 


PRELAUNCH : 

/NA 

RTLS : 

2/1R 

mm 

LIFTOFF: 

2/1R 

TAL: 

2/1R 


• ONORBIT: 

/NA 

AOA: 

/NA 


DEORBIT : 

/NA 

ATO: 

* /NA 

— 

LANDING/ SAFING: 

/NA 



Wr-s 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: 

PART NUMBER: MC453-0021-0009 , SKD26100094 


CAUSES: MECHANICAL/STRUCTURAL MALFUNCTION, CORROSION, 

CONTAMINATION, CHEMICAL DETERIORATION. 

EFFECTS/RATIONALE : 

FAILURE OF ONE DETONATOR OF A GIVEN PAIR WOULD NOT BE DETECTABLE. 
EITHER DUAL REDUNDANT DETONATOR IS CAPABLE OF PERFORM THE 
INTENDED FUNCTION TO FRACTURE ITS FRANGIBLE NUT TO EFFECT PLATE 
SEPARATION. 

ANY DUAL FAILURE OF A MATED PAIR OF DETONATORS COULD CAUSE 
INABILITY TO EFFECT UMBILICAL PLATE SEPARATION. 

INABILITY TO EFFECT SEPARATION OF EITHER UMBILICAL PLATE WOULD 
CAUSE LOSS OF VEHICLE/ CREW. 

REFERENCES: MC453-0021 


REPORT DATE 01/05/88 


C-21 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 11/23/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4664 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: DETONATOR 

FAILURE MODE: INADVERTENT OPERATION 


LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 


BREAKDOWN HIERARCHY : 

1) ORBITER/EXTERNAL TANK (ET) SEPARATION MECHANISMS PYROS 

2) UMBILICAL PLATE SEPARATION 

3) FRANGIBLE NUT 

4 ) DETONATOR 

5) (2 PER NUT) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH : 

1/1 

RTLS: 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT : 

/NA 

AOA: 

/NA 

DEORBIT : 
LANDING/SAFING 

/NA 
: /NA 

ATO: 

/NA 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: 

PART NUMBER: MC453-0021-0009 , SKD26100094 

CAUSES: HIGH TEMPERATURE ENVIRONMENT, MECHANICAL/ STRUCTURAL 

MALFUNCTION, SHOCK, CORROSION, CONTAMINATION, CHEMICAL 
DETERIORATION. 

EFFECTS/RATIONALE : 

PREMATURE OPERATION OF ANY DETONATOR WOULD CAUSE FRACTURE OF THE 
RESPECTIVE FRANGIBLE NUT. THERE ARE THREE NUTS STRUCTURALLY 
TYING EACH (1 LEFT/1 RIGHT) UMBILICAL PLATE. 

FAILURE OF ANY ONE OF THE SIX NUTS WOULD REDUCE STRUCTURAL 
INTEGRITY AND POSSIBLY BE SUFFICIENT TO ALLOW LOSS OF 02 OR H2 
WHICH COULD CAUSE FIRE. 

ULTIMATELY THE PREMATURE FRACTURE OF ONE OF THE SIX FRANGIBLE 
NUTS COULD LEAD TO OTHER FAILURES THAT COULD POSSIBLY CAUSE LOSS 
OF VEHICLE/ CREW. 

REFERENCES: MC453-0021 


REPORT DATE 01/05/88 


C-22 


INDEPENDENT ORBITER ASSESSMENT 

orbiter Subsystem analysis worksheet 


DATE: 12/18/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4701 


HIGHEST CRITICALITY 
FLIGHT : 
ABORT : 


HDW/FUNC 

1/1 

/NA 


ITEM: GUILLOTINE ASSY, PYROTECHNIC 

FAILURE MODE: FAIL TO FUNCTION UPON RECEIVING NOMINAL PRESSURE 


LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 

BREAKDOWN HIERARCHY: 

1) RENDEZVOUS RADAR ANTENNA EMERGENCY RELEASE 

2) GUILLOTINE ASSY, PYROTECHNIC 

3) (DUAL PRESSURE CARTRIDGES) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 



FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 


PRE LAUNCH: 

/NA 

RTLS: 

/NA 

** 

LIFTOFF: 

/NA 

TAL: 

/NA 


ONORBIT: 

1/1 

AOA: 

/NA 


DEORBIT: 

/NA 

ATO: 

/NA 

— 

LANDING/SAFING 

: /NA 



- • 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION : 





PART NUMBER: MC325-0024-0001, 

SKD2 6 100105-2 01 



CAUSES: MECHANICAL/ STRUCTURAL MALFUNCTION, CORROSION, 

CONTAMINATION, CHEMICAL DETERIORATION. 


EFFECTS/RATIONALE : 

SEVERING THE ELECTRICAL UMBILICAL IS REQUIRED TO EFFECT JETTISON 
OF THE RR ANTENNA IF REQUIRED. 

INABILITY TO STOW OR JETTISON THE ANTENNA COULD PREVENT PAYLOAD 
BAY DOOR CLOSING. 

INABILITY TO CLOSE THE PAYLOAD BAY DOORS COULD RESULT IN LOSS OF 
VEHICLE/ CREW. 

REFERENCES: MC325-0024 


REPORT DATE 01/05/88 


C-23 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 12/18/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4702 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/2 

ABORT : /NA 


ITEM: GUILLOTINE ASSY, PYROTECHNIC 

FAILURE MODE : INADVERTENT OPERATION 


LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 


BREAKDOWN HIERARCHY: 

1) RENDEZVOUS RADAR ANTENNA EMERGENCY RELEASE 

2) GUILLOTINE ASSY, PYROTECHNIC 

3) (DUAL PRESSURE CARTRIDGES) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

/NA 

RTLS: 

/NA 

LIFTOFF: 

/NA 

TAL: 

/NA 

ONORBIT: 

2/2 

AOA: 

/NA 

DEORBIT: 
LANDING/ SAFING 

/NA 
: /NA 

ATO: 

/NA 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: 

PART NUMBER: MC325-0024-0001 , SKD26100105-201 

CAUSES: HIGH TEMPERATURE ENVIRONMENT, MECHANICAL/ STRUCTURAL 

MALFUNCTION, SHOCK, CORROSION, CONTAMINATION, CHEMICAL 
DETERIORATION. 

EFFECTS/RATIONALE : 

UNTIMELY OPERATION OF THE RENDEZVOUS RADAR GUILLOTINE ASSY PYRO 
WOULD SEVER THE ELECTRICAL UMBILICAL. 

UNTIMELY SEVERING OF THE ELECTRICAL UMBILICAL WOULD DISABLE ANY 
USE OF THE ANTENNA. 

LOSS OF RENDEZVOUS RADAR WOULD CAUSE LOSS OF MISSION. 


REFERENCES: MC325-0024 


REPORT DATE 01/05/88 


C-24 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 12/18/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4703 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: /NA 


ITEM: PRESSURE CARTRIDGE (2) 

FAILURE MODE: FAIL TO FUNCTION 


LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 


BREAKDOWN HIERARCHY: 


1 ) 

2 ) 

3) 

4) 

5) 

6) 

7) 

8 ) 
9) 


RENDEZVOUS RADAR ANTENNA EMERGENCY RELEASE 
GUILLOTINE ASSY, PYROTECHNIC 
PRESSURE CARTRIDGE (2) 


FLIGHT PHASE 
PRELAUNCH : 
LIFTOFF: 

ONORBIT : 

DEORBIT : 
LANDING/SAFING: 


CRITICALITIES 


HDW/FUNC 

/NA 

/NA 

2/1R 

/NA 

/NA 


ABORT 
RTLS : 
TAL: 
AO A: 
ATO: 


HDW/FUNC 

/NA 

/NA 

/NA 

/NA 


REDUNDANCY SCREENS: A [NA ] 


B [NA ] C [NA ] 


LOCATION: 

PART NUMBER: MC325-0024-0002 , SKD26100105-301 


CAUSES : MECHANICAL/ STRUCTURAL MALFUNCTION, CORROSION , 

CONTAMINATION, CHEMICAL DETERIORATION. 


EFFECTS/RATIONALE : 

ONE CARTRIDGE FAILING WOULD NOT PREVENT OPERATION OF THE 
GUILLOTINE ASSY. SEVERING THE ELECTRICAL UMBILICAL IS REQUIRED 
TO EFFECT JETTISON OF THE RR ANTENNA IF REQUIRED. 

INABILITY TO STOW OR JETTISON THE ANTENNA COULD PREVENT PAYLOAD 
BAY DOOR CLOSING. 

INABILITY TO CLOSE THE PAYLOAD BAY DOORS COULD RESULT IN LOSS OF 
VEHICLE/ CREW. 

REFERENCES: MC325-0024 


REPORT DATE 01/05/88 


C-25 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 12/18/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4704 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/2 

ABORT: /NA 


ITEM: PRESSURE CARTRIDGE (2) 

FAILURE MODE: INADVERTENT OPERATION 


LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 


BREAKDOWN HIERARCHY: 

1) RENDEZVOUS RADAR ANTENNA EMERGENCY RELEASE 

2) GUILLOTINE ASSY, PYROTECHNIC 

3) PRESSURE CARTRIDGE (2) _ 

4) 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

/NA 

RTLS: 

/NA 

LIFTOFF: 

/NA 

TAL: 

/NA 

ONORBIT: 

2/2 

AO A: 

/NA 

DEORBIT: 

/NA 

ATO: 

/NA 

LANDING/ SAFING 

: . /NA 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: 

PART NUMBER: MC325-0024-0002 , SKD26100105-301 

CAUSES: HIGH TEMPERATURE ENVIRONMENT, ME CHAN I CAL/ STRUCTURAL 

MALFUNCTION, SHOCK, CORROSION, CONTAMINATION, CHEMICAL 
DETERIORATION. 


EFFECTS/RATIONALE : 

UNTIMELY OPERATION OF THE RENDEZVOUS RADAR GUILLOTINE ASSY PYRO 
WOULD SEVER THE ELE CTRICAL ^ UMBILI CAL. ^ , •• - 

UNTIMELY SEVERING OF THE ELECTRICAL UMBILICAL WOULD DISABLE ANY 
USE OF THE ANTENNA. 

LOSS OF RENDEZVOUS RADAR WOULD CAUSE LOSS OF MISSION. 


REFERENCES: MC325-0024 


REPORT DATE 01/05/88 


C-26 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

HDW/FUNC 
1/1 
/NA 


DATE: 

SUBSYSTEM: 
MDAC ID: 


12/18/87 

PYROTECHNICS 

4705 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT : 


ITEM: RELEASE NUT 

FAILURE MODE: FAIL TO FUNCTION UPON RECEIVING NOMINAL PRESSURE 

OUTPUT 


LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 


BREAKDOWN HIERARCHY: 

1) RENDEZVOUS RADAR ANTENNA EMERGENCY RELEASE 

2) RELEASE NUT 

3) (DUAL PRESSURE CARTRIDGES) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 



CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

/NA 

RTLS: 

/NA 

LIFTOFF: 

/NA 

TAL: 

/NA 

ONORBIT: 

1/1 

AOA: 

/NA 

DEORBIT: 

/NA 

ATO: 

/NA 

LANDING/SAFING 

: /NA 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: 

PART NUMBER: ME325-0025-0001 , SKD26100105-501 

CAUSES: MECHANICAL/STRUCTURAL MALFUNCTION, CORROSION, 

CONTAMINATION, CHEMICAL DETERIORATION. 

EFFECTS/RATIONALE : 

INABILITY TO SEPARATE THE RENDEZVOUS RADAR ANTENNA WHEN IT CANNOT 
BE SAFELY AND PROPERLY STOWED WOULD PREVENT CLOSURE OF THE 
PAYLOAD BAY DOORS. 

IF THE PAYLOAD BAY DOORS CANNOT BE CLOSED THEN DEORBIT CANNOT BE 
ACCOMPLISHED. 

IF SAFE DEORBIT CANNOT BE ACCOMPLISHED LOSS OF THE VEHICLE/CREW 
COULD RESULT . 

REFERENCES: MC325-0025 


REPORT DATE 01/05/88 


C-27 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 12/18/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4706 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: RELEASE NUT 

FAILURE MODE: INADVERTENT OPERATION 


LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 


BREAKDOWN HIERARCHY: 

1) RENDEZVOUS RADAR ANTENNA EMERGENCY RELEASE 

2) RELEASE NUT 

3) (DUAL PRESSURE CARTRIDGES) 

4) 

5) 

6 ) 

7) 

8 ) 

9 ) 


FLIGHT PHASE 
PRELAUNCH : 
LIFTOFF: 
ONORBIT : 
DEORBIT : 
LANDING/SAFING 


CRITICALITIES 


HDW/FUNC 

2/2 

1/1 

2/2 

1/1 

/NA 


ABORT 
RTLS : 
TAL: 
AOA: 
ATO: 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 


REDUNDANCY SCREENS: A [NA ] 


B [NA ] C [NA ] 


LOCATION: 

PART NUMBER: ME325-0025-0001 , SKD26100105-501 


CAUSES: HIGH TEMPERATURE ENVIRONMENT, MECHANICAL/STRUCTURAL 

MALFUNCTION, SHOCK, CORROSION, CONTAMINATION, CHEMICAL 
DETERIORATION. 


EFFECTS/RATIONALE : 

INADVERTENT SEPARATION OF THE RENDEZVOUS RADAR ANTENNA DURING 
ASCENT COULD PHYSICALLY DAMAGE THE ORBITER AND PAYLOADS. 
DEPENDING ON THE LEVEL OF THE PHYSICAL/ STRUCTURAL DAMAGE TO THE 
ORBITER AND PAYLOADS, POSSIBLE CAUSE LOSS OF THE 
PAYLOADS/ORBITER/CREW COULD RESULT. 


REFERENCES: MC325-0025 


REPORT DATE 01/05/88 


C-28 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

12/18/87 

HIGHEST CRITICALITY 

HDW/FUNC 

SUBSYSTEM: 

PYROTECHNICS 

FLIGHT : 

2/1R 

MDAC ID: 

4707 

ABORT : 

/NA 

ITEM: 

FAILURE MODE 

PRESSURE CARTRIDGE 
: FAIL TO FUNCTION 

(2) 


LEAD ANALYST 

: W. W. ROBINSON 

SUBSYS LEAD: ROBINSON 



BREAKDOWN HIERARCHY: 

1) RENDEZVOUS RADAR ANTENNA EMERGENCY RELEASE 

2 ) RELEASE NUT 

3) PRESSURE CARTRIDGES (2) 

4) 

5) 

6 ) 

7) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH : 

/NA 

RTLS: 

/NA 

LIFTOFF: 

/NA 

TAL: 

/NA 

ONORBIT : 

2/1R 

AO A: 

/NA 

DEORBIT : 

/NA 

ATO: 

/NA 

LANDING/SAFING 

: /NA 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: 

PART NUMBER: ME325-0025-0003 , SKD26100105-301 

CAUSES: HIGH TEMPERATURE ENVIRONMENT, MECHANICAL/STRUCTURAL 

MALFUNCTION, SHOCK, CORROSION, CONTAMINATION, CHEMICAL 
DETERIORATION. 

EFFECTS/RATIONALE : 

FAILURE OF BOTH WOULD BE REQUIRED BEFORE FAILURE OF RELEASE NUT 
WOULD NOMINALLY OCCUR. INABILITY TO RELEASE THE RENDEZVOUS RADAR 
ANTENNA WHEN IT CANNOT BE SAFELY AND PROPERLY STOWED WOULD 
PREVENT CLOSURE OF THE PAYLOAD BAY DOORS . 

INABILITY TO PROPERLY CLOSE THE PAYLOAD BAY DOORS WOULD ENDANGER 
SAFE DEORBIT. 

IF SAFE DEORBIT CANNOTT BE ACCOMPLISHED, LOSS OF CREW/VEHICLE 
COULD RESULT. 

REFERENCES: MC325-0025 


REPORT DATE 01/05/88 


C-29 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 12/18/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4708 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: PRESSURE CARTRIDGE (2) 

FAILURE MODE: INADVERTENT OPERATION 


LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 


BREAKDOWN HIERARCHY: 

1) RENDEZVOUS RADAR ANTENNA EMERGENCY RELEASE 

2) RELEASE NUT 

3) PRESSURE CARTRIDGES (2) 

4 ) 

5 ) 

6 ) 

7 ) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

2/2 

RTLS: 

1/1 

LIFTOFF : 

1/1 

TAL: 

1/1 

ONORBIT : 

2/2 

AOA: 

1/1 

DEORBIT : 

1/1 

ATO: 

1/1 

LANDING/SAFING: 

/NA 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: 

PART NUMBER: ME325-0025-0003 , SKD26100105-301 

CAUSES: HIGH TEMPERATURE ENVIRONMENT, MECHANICAL/STRUCTURAL 

MALFUNCTION, SHOCK, CORROSION, CONTAMINATION, CHEMICAL 
DETERIORATION. 

EFFECTS/RATIONALE : 

INADVERTENT SEPARATION OF THE RENDEZVOUS RADAR ANTENNA DURING 
ASCENT COULD PHYSICALLY DAMAGE THE ORBITER AND PAYLOADS. 
DEPENDING ON THE LEVEL OF THE “PHYSICAL/STRUCTURAL DAMAGE TO THE 
ORBITER AND PAYLOADS, POSSIBLE CAUSE LOSS OF THE 
PAYLOADS /ORBITER/ CREW COULD RESULT. 


REFERENCES: MC325-0025 


REPORT DATE 01/05/88 


C-3 0 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 11/23/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4751 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: /NA 


ITEM: RETRACTOR - MANIPULATOR ARM RELEASE 

FAILURE MODE: FAILS TO FUNCTION 


LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 


BREAKDOWN HIERARCHY: 

1) PAYLOAD RETENTION & DEPLOY 

2) MANIPULATOR POSITIONING/RETENTION MECHANISM 

3) RETRACTOR - MANIPULATOR ARM RELEASE 

4) (4 PER ARM) 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH : 

/NA 

RTLS: 

/NA 

LIFTOFF: 

/NA 

TAL: 

/NA 

ONORBIT: 

1/1 

AOA: 

/NA 

DEORBIT: 

/NA 

ATO: 

/NA 

LANDING/ SAFING: 
REDUNDANCY SCREENS: 

/NA 
A [NA ] 

B [NA ] 

C [NA ] 


LOCATION : 

PART NUMBER: MC325-0021-0001 , SKD26100104-201 


CAUSES: MECHANICAL/ STRUCTURAL MALFUNCTION, CORROSION, 

CONTAMINATION, CHEMICAL DETERIORATION. 


EFFECTS/RATIONALE : 

FAILURE OF THE MANIPULATOR ARM RELEASE RETRACTOR TO RELEASE WHEN 
COMMANDED TO DO SO WOULD RESULT IN INABILITY TO JETTISON AN ARM 
WHEN REQUIRED. 

INABILITY TO JETTISON AN ARM WHEN REQUIRED COULD RESULT IN LOSS 
OF VEHICLE/ CREW. 


REFERENCES : 


MC325-0021 


REPORT DATE 01/05/88 


C-3 1 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 11/23/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4752 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: RETRACTOR - MANIPULATOR ARM RELEASE 

FAILURE MODE: INADVERTENT OPERATION 


LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 


BREAKDOWN HIERARCHY: 

1) PAYLOAD RETENTION & DEPLOY 

2) MANIPULATOR POSITIONING/RETENTION MECHANISM 

3) RETRACTOR - MANIPULATOR ARM RELEASE 

4) (4 PER ARM) 

5 ) 

6 ) 

7 ) 

8 ) 

9 ) 



CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

2/2 

RTLS: 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT : 

1/1 

AOA: 

1/1 

DEORBIT : 

1/1 

ATO: 

1/1 

LANDING/SAFING 

: /NA 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION : 

PART NUMBER: MC325-0021-0001, SKD26100104-201 

CAUSES: HIGH TEMPERATURE ENVIRONMENT, MECHANICAL/STRUCTURAL 

MALFUNCTION, SHOCK, CORROSION, CONTAMINATION, CHEMICAL 
DETERIORATION. 


EFFECTS/RATIONALE : 

UNTIMELY OPERATION OF THE RMS ARM COULD CAUSE PHYSICAL/STRUCTURAL 
DAMAGE TO THE ORBITER/ PAYLOADS . 

DEPENDING ON THE NATURE OF THE DAMAGE TO THE ORBITER POSSIBLE 
LOSS OF VEHICLE/ CREW COULD RESULT. 


REFERENCES: MC325-0021 


REPORT DATE 01/05/88 


C-32 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 11/23/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4753 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: /NA 


ITEM: GUILLOTINE ASSY PYRO 

FAILURE MODE: FAILS TO FUNCTION 


LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 

BREAKDOWN HIERARCHY : 

1) PAYLOAD RETENTION & DEPLOY 

2) MANIPULATOR POSITIONING/RETENTION MECHANISM 

3) GUILLOTINE ASSY PYRO 

4) RMS SHOULDER UMBILICAL SEPARATION 

5) (1 PER ARM) TYPE I 

6 ) 

7 ) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

/NA 

RTLS : 

/NA 

LIFTOFF: 

/NA 

TAL: 

/NA 

ONORBIT: 

1/1 

AOA: 

/NA 

DEORBIT: 

LANDING/SAFING 

/NA 
: /NA 

ATO: 

/NA 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: 

PART NUMBER: MC325-0022-0001 , SKD26100103-201 


CAUSES: MECHANICAL/STRUCTURAL MALFUNCTION, CORROSION, 

CONTAMINATION, CHEMICAL DETERIORATION. 


EFFECTS/RATIONALE : 

FAILURE OF THE RMS SHOULDER UMBILICAL SEPARATION GUILLOTINE ASSY 
TO RELEASE WHEN COMMANDED TO DO SO WOULD RESULT IN INABILITY TO 
JETTISON AN ARM WHEN REQUIRED. 

INABILITY TO JETTISON AN ARM WHEN REQUIRED COULD RESULT IN LOSS 
OF VEHICLE/ CREW. 


REFERENCES: MC325-0022 


REPORT DATE 01/05/88 


C-33 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 11/23/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4754 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: /NA 


ITEM: GUILLOTINE ASSY PYRO 

FAILURE MODE: INADVERTENT OPERATION 


LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 


BREAKDOWN HIERARCHY: 

1) PAYLOAD RETENTION & DEPLOY 

2) MANIPULATOR POSITIONING/RETENTION MECHANISM 

3) GUILLOTINE ASSY PYRO 

4) RMS SHOULDER UMBILICAL SEPARATION 

5) (1 PER ARM) TYPE I 

6 ) 

7 ) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

2/2 

RTLS: 

/NA 

LIFTOFF: 

2/2 

TAL: 

/ NA 

ONORBIT: 

1/1 

AO A: 

/NA 

DEORBIT: 
LANDING/ SAFING 

/NA 
: /NA 

ATO: 

/NA 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: 

PART NUMBER: MC325-0022-0001 , SKD26100103-201 

CAUSES: HIGH TEMPERATURE ENVIRONMENT, MECHANICAL/STRUCTURAL 

MALFUNCTION, SHOCK, CORROSION, CONTAMINATION, CHEMICAL 
DETERIORATION. 

EFFECTS /RATIONALE : 

UNTIMELY OPERATION OF THE RMS SHOULDER UMBILICAL SEPARATION 
GUILLOTINE ASSY WHILE THE ARM IS IN USE WOULD CAUSE LOSS OF 
CONTROL OF THE ARM WITH POSSIBLE PHYSICAL/STRUCTURAL DAMAGE TO 
THE ORBITER/ PAYLOADS 

DEPENDING ON THE EXTENT AND TYPE OF DAMAGE TO THE ORBITER, LOSS 
OF VEHICLE/ CREW COULD RESULT. 


REFERENCES: MC325-0022 


REPORT DATE 01/05/88 


C-34 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 11/23/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4755 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: /NA 


ITEM: GUILLOTINE ASSY 

FAILURE MODE: FAILS TO FUNCTION WHEN BOTH INITIATORS ARE FIRED. 


LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 


BREAKDOWN HIERARCHY: 

1) PAYLOAD RETENTION & DEPLOY 

2) MANIPULATOR POSITIONING/RETENTION MECHANISM 

3) RMS PEDESTAL UMBILICAL SEPARATION 

4) GUILLOTINE ASSY 

5) (3 PER ARM) TYPE II 

6 ) 

7 ) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

/NA 

RTLS : 

/NA 

LIFTOFF: 

/NA 

TAL: 

/NA 

ONORBIT : 

1/1 

AOA: 

/NA 

DEORBIT : 

/NA 

ATO: 

/NA 

LANDING/SAFING 

: /NA 

-• 


REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 

LOCATION: 




PART NUMBER: MC325-0022-0002 , 

SKD2611001Q3-301 



CAUSES: MECHANICAL/STRUCTURAL MALFUNCTION, CORROSION, 

CONTAMINATION, CHEMICAL DETERIORATION. 

EFFECTS/RATIONALE : 

FAILURE OF THE RMS PEDESTAL UMBILICAL SEPARATION GUILLOTINE ASSY 
TO FUNCTION TO SEVER THE ELECTRICAL WIRE BUNDLE WOULD PREVENT 
JETTISON OF THE ARM WHEN REQUIRED. 

INABILITY TO JETTISON AN ARM WHEN REQUIRED COULD RESULT IN LOSS 
OF VEHICLE/CREW. 


REFERENCES: MC325-0022 


REPORT DATE 01/05/88 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 11/23/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4756 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/2 

ABORT : /NA 


ITEM: GUILLOTINE ASSY 

FAILURE MODE: INADVERTENT OPERATION 


LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 


BREAKDOWN HIERARCHY: 

1) PAYLOAD RETENTION & DEPLOY 

2) MANIPULATOR POSITIONING/RETENTION MECHANISM 

3) GUILLOTINE ASSY 

4) RMS PEDESTAL UMBILICAL SEPARATION 

5) (3 PER ARM) TYPE II 

6 ) 

7 ) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

2/2 

RTLS; 

/NA 

LIFTOFF: 

2/2 

TAL: 

/NA 

ONORBIT: 

2/2 

AOA: 

/NA 

DEORBIT: 

LANDING/SAFING 

/NA 
: /NA 

ATO: 

/NA 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: 

PART NUMBER: MC325-0022-0002 , SKD261100103-301 

CAUSES: HIGH TEMPERATURE ENVIRONMENT, MECHANICAL/STRUCTURAL 

MALFUNCTION, SHOCK, CORROSION, CONTAMINATION, CHEMICAL 
DETERIORATION. 


EFFECTS/RATIONALE : 

UNTIMELY OPERATION OF THE RMS PEDESTAL UMBILICAL SEPARATION 
GUILLOTINE ASSY WOULD ABILITY TO STOW/ DEPLOY THE ARM. 

INABILITY TO DELOY THE ARM COULD CAUSE LOSS OF MISSION. 
INABILITY TO STOW THE ARM WOULD REQUIRE THE ARM BE JETISSONED. 


REFERENCES: MC325-0022 


REPORT DATE 01/05/88 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 11/23/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4801 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: /NA 


ITEM: OUTER WINDOW ASSY 

FAILURE MODE: FAILS TO OPEN 


LEAD ANALYST: W. W. ROBINSON 


SUBSYS LEAD: ROBINSON 


BREAKDOWN HIERARCHY: 

1) CREW STATION & EQUIPMENT 

2) EMERGENCY EGRESS 

3) OUTER WINDOW ASSY 

4) 

5) 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

/NA 

RTLS : 

/NA 

LIFTOFF: 

/NA 

TAL: 

/NA 

ONORBIT: 

/NA 

AOA: 

/NA 

DEORBIT : 
LANDING/SAFING 

/NA 
: 1/1 

ATO: 

/NA 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: 

PART NUMBER: VO70-553302 


CAUSES: MECHANICAL/ STRUCTURAL MALFUNCTION, CORROSION, 

CONTAMINATION, CHEMICAL DETERIORATION. 

EFFECTS/RATIONALE : 

EMERGENCY CREW EGRESS CAPABILITY WILL NOT BE PROVIDED IN 
SITUATIONS WHERE IT IS NEEDED. 

LOSS OF CREW COULD RESULT IF EMERGENCY CREW EGRESS NOT AVAILABLE 
WHEN REQUIRED. 


REFERENCES: V070-553302 


REPORT DATE 01/05/88 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

11/23/87 

HIGHEST CRITICALITY 

HDW/FUNC 

SUBSYSTEM: 

PYROTECHNICS 

FLIGHT: 

1/1 • 

MDAC ID: 

4802 

ABORT : 

/NA 

ITEM: 

INNER WINDOW ASSY 



FAILURE MODE 

: FAILS TO OPEN 



LEAD ANALYST 

: W. W. ROBINSON 

SUBSYS LEAD: ROBINSON 



BREAKDOWN HIERARCHY: 

1) CREW STATION & EQUIPMENT 

2) EMERGENCY EGRESS 

3) INNER WINDOW ASSY 

4) 

5) 

6 ) 

7) 

8 ) 

9) 


HDW/FUNC 

/NA 

/NA 

/NA 

/NA 



CRITICALITIES 

FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

/NA 

RTLS 

LIFTOFF: 

/NA 

TAL: 

ONORBIT: 

/NA 

AOA: 

DEORBIT : 

/NA 

ATO: 

LANDING/SAFING: 

1/1 



REDUNDANCY SCREENS: A [NA ] 


B [NA ] C [NA ] 


LOCATION: 

PART NUMBER: VO70-553303 


CAUSES: MECHANICAL/STRUCTURAL MALFUNCTION, CORROSION, 

CONTAMINATION, CHEMICAL DETERIORATION. 


EFFECTS /RATIONALE : 

EMERGENCY CREW EGRESS CAPABILITY WILL NOT BE PROVIDED IN 
SITUATIONS WHERE IT IS NEEDED. 

LOSS OF CREW COULD RESULT IF EMERGENCY CREW EGRESS NOT AVAILABLE 
WHEN REQUIRED. 


REFERENCES : V070-553302 


REPORT DATE 02/03/88 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 11/23/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4803 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: /NA 


ITEM: ENERGY TRANSFER SYSTEM 

FAILURE MODE: REDUCED OR NO OUTPUT 


LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 


BREAKDOWN HIERARCHY: 

1) CREW STATION & EQUIPMENT 

2 ) EMERGENCY EGRESS 

3) ENERGY TRANSFER SYSTEM 

4) 

5) 

6 ) 

7) 

8 ) 

9) 


FLIGHT PHASE 
PRE LAUNCH: 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/SAFING 


CRITICALITIES 


HDW/FUNC 

/NA 

/NA 

/NA 

/NA 

2/1R 


ABORT 

RTLS: 

TAL: 

AOA: 

ATO: 


HDW/FUNC 

/NA 

/NA 

/NA 

/NA 


REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 


LOCATION: 

PART NUMBER: MC325-0004 

CAUSES : MECHANICAL/STRUCTURAL MALFUNCTION, CORROSION, 

CONTAMINATION, CHEMICAL DETERIORATION. 


EFFECTS/RATIONALE : 

REDUNDANT FAILURE OF ENERGY TRANSFER SYSTEM COULD RESULT IN LOSS 
OF EMERGENCY CREW EGRESS CAPABILITY IN SITUATIONS WHERE IT IS 
NEEDED. 

LOSS OF CREW COULD RESULT IF EMERGENCY CREW EGRESS NOT AVAILABLE 
WHEN REQUIRED. 


REFERENCES: MC3 2 5-0004 


REPORT DATE 01/05/88 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 11/23/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4804 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: /NA 


ITEM: INITIATOR ASSY PYRO 

FAILURE MODE: NO OUTPUT 


LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 


BREAKDOWN HIERARCHY: 

1) CREW STATION & EQUIPMENT 

2) EMERGENCY EGRESS 

3) INITIATOR ASSY PYRO 

4) 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

/NA 

RTLS: 

/NA 

LIFTOFF: 

/NA 

TAL: 

/NA 

ONORBIT : 

/NA 

AOA: 

/NA 

DEORBIT : 

/NA 

ATO: 

/NA 

LANDING/ SAFING: 

2/1R 

' • » 


REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: 

PART NUMBER: MC325-0005-0003 , -0005 

CAUSES: MECHANICAL/STRUCTURAL MALFUNCTION, CORROSION, 

CONTAMINATION, CHEMICAL DETERIORATION. 


EFFECTS /RATIONALE * 

REDUNDANT FAILURE OF WINDOW SEVERENCE FUNCTION COULD RESULT IN 
LOSS OF EMERGENCY CREW EGRESS CAPABILITY IN SITUATIONS WHERE IT 
IS NEEDED. 

LOSS OF CREW COULD RESULT IF EMERGENCY CREW EGRESS NOT AVAILABLE 
WHEN REQUIRED. 


REFERENCES: MC325-0005 


REPORT DATE 01/05/88 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 11/23/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4805 


HIGHEST CRITICALITY 
. FLIGHT: 

ABORT: 


HDW/FUNC 

2/1R 

/NA 


ITEM: 0.3 -SEC TIME DELAY CARTRIDGE ASSY 

FAILURE MODE: NO OUTPUT, EXCESSIVE DELAY OF CARTRIDGE FIRING. 


LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 


BREAKDOWN HIERARCHY: 

1) CREW STATION & EQUIPMENT 

2) EMERGENCY EGRESS 

3) 0.3 SEC TIME DELAY CARTRIDGE ASSY 

4) 

5) 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

/NA 

RTLS: 

/NA 

LIFTOFF: 

/NA 

TAL: 

/NA 

ONORBIT : 

/NA 

AOA: 

/NA 

DEORBIT : 
LANDING/ SAFING: 

/NA 

2/1R 

ATO: 

/NA 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: 

PART NUMBER: MC325-0004-0003 


CAUSES: MECHANICAL/STRUCTURAL MALFUNCTION, CORROSION, 

CONTAMINATION, CHEMICAL DETERIORATION. 


EFFECTS/RATIONALE : 

COULD RESULT IN EXCESSIVE TIME BEFORE MAKING CREW EMERGENCY 
EGRESS POSSIBLE. 

LOSS OF CREW COULD RESULT IF EMERGENCY CREW EGRESS NOT AVAILABLE 
IN TIME WHEN REQUIRED. 


REFERENCES: MC325-0004 


REPORT DATE 01/05/88 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 11/23/87 

SUBSYSTEM: PYROTECHNICS 

MDAC ID: 4806 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT : /NA 


ITEM: THRU BULKHEAD INITIATOR 

FAILURE MODE: NO OUTPUT 

LEAD ANALYST: W. W. ROBINSON SUBSYS LEAD: ROBINSON 


BREAKDOWN HIERARCHY: 

1) CREW STATION & EQUIPMENT 

2) EMERGENCY EGRESS 

3) THRU BULKHEAD INITIATOR 

4) 

5) 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

/NA 

RTLS: 

/NA 

LIFTOFF: 

/NA 

TAL: 

/NA 

ONORBIT: 

/NA 

AOA: 

/NA 

DEORBIT : 

/NA 

ATO: 

/NA 

LANDING/SAFING 

: 2/1R 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: 

PART NUMBER: MC325-0004-0003 , -0023, SKD26100108-301 , -401 

CAUSES: HIGH TEMPERATURE ENVIRONMENT, MECHANICAL/STRUCTURAL 

MALFUNCTION, SHOCK, CORROSION, CONTAMINATION, CHEMICAL 
DETERIORATION. . 


EFFECTS/RATIONALE : 

DUAL FAILURE COULD RESULT IN LOSS OF EMERGENCY CREW EG RESS 

CAPABILITY . ' 

LOSS OF CREW COULD RESULT IF EMERGENCY CREW EGRESS NOT AVAILABLE 
WHEN REQUIRED. 


REFERENCES: MC 325-0004 


REPORT DATE 01/05/88 C-42 



APPENDIX D 


POTENTIAL CRITICAL ITEMS 


MDAC-ID 

FLIGHT 

ITEM 


FAILURE MODE 

4601 

1/1 

THRUSTER 

ASSY 

FAILS TO OPERATE 

4602 

2/1R 

PRESSURE 

CARTRIDGE 

FAILS TO OPERATE 

4603 

1/1 

PRESSURE 

CARTRIDGE 

INADVERTENT OPERATION 

4604 

2/1R 

THRUSTER 

ASSY 

FAILS TO OPERATE 

4605 

2/1R 

PRESSURE 

CARTRIDGE 

FAILS TO OPERATE 

4606 

1/1 

PRESSURE 

CARTRIDGE 

FIRES INADVERTENTLY 

4607 

1/1 

THRUSTER 

ASSY 

FAILS TO OPERATE 

4608 

1/1 

PRESSURE 

CARTRIDGE 

FAILS TO OPERATE 

4609 

1/1 

PRESSURE 

CARTRIDGE 

FIRES INADVERTENTLY 

4651 

1/1 

SHEAR BOLT 

PREMATURE BOLT FRACTURE 

4652 

1/1 

SHEAR BOLT 

FAILS TO FRACTURE 

4653 

2/1R 

PRESSURE 

CARTRIDGE 

FAILS TO FUNCTION 

4654 

1/1 

PRESSURE 

CARTRIDGE 

INADVERTENT OPERATION 

4655 

1/1 

FRANGIBLE 

NUT 

PREMATURE FRACTURE 

4656 

1/1 

FRANGIBLE 

NUT 

FAILS TO FRACTURE 

4657 

2/1R 

DETONATOR 

BOOSTER (2) 

FAILS TO FIRE 

4658 

1/1 

DETONATOR 

BOOSTER (2) 

INADVERTENT OPERATION 

4661 

1/1 

FRANGIBLE 

NUT 

FAILS TO FRACTURE 

4662 

1/1 

FRANGIBLE 

NUT 

PREMATURE FRACTURE 

4663 

2/1R 

DETONATOR 

FAILS TO FIRE 

4664 

1/1 

DETONATOR 

INADVERTENT OPERATION 


D-l 




APPENDIX D (CONT'D) 


MDAC-ID 

FLIGHT 

POTENTIAL CRITICAL ITEMS 

ITEM 

FAILURE MODE 

4701 

1/1 

GUILLOTINE ASSY, 
PYROTECHNIC 

FAILS TO FUNCTION 

4702 

2/2 

GUILLOTINE ASSY, 
PYROTECHNIC 

INADVERTENT OPERATION 

4703 

1/1 

PRESSURE CARTRIDGE (2) 

FAILS TO FUNCTION 

4704 

2/2 

PRESSURE CARTRIDGE (2) 

INADVERTENT OPERATION 

4705 

1/1 

RELEASE NUT 

FAILS TO FUNCTION 

4706 

1/1 

RELEASE NUT 

INADVERTENT OPERATION 

4707 

2/1R 

PRESSURE CARTRIDGE (2) 

FAILS TO FUNCTION 

4708 

1/1 

PRESSURE CARTRIDGE (2) 

INADVERTENT OPERATION 

4751 

1/1 

RETRACTOR - MANIPULATOR 
ARM RELEASE 

FAILS TO FUNCTION 

4752 

1/1 

RETRACTOR - MANIPULATOR 
ARM RELEASE 

INADVERTENT OPERATION 

4753 

1/1 

GUILLOTINE ASSY PYRO 

FAILS TO FUNCTION 

4754 

1/1 

GUILLOTINE ASSY PYRO 

INADVERTENT OPERATION 

4755 

1/1 

GUILLOTINE ASSY 

FAILS TO FUNCTION 

4756 

2/2 

GUILLOTING ASSY 

INADVERTENT OPERATION 

4801 

1/1 

OUTER WINDOW ASSY 

FAILS TO OPEN 

4802 

1/1 

OUTER WINDOW ASSY 

FAILS TO OPEN 

4803 

2/1R 

ENERGY TRANSFER SYSTEM 

REDUCED OR NO OUTPUT 

4804 

2/1R 

INITIATOR ASSY PYRO 

NO OUTPUT 

4805 

2/1R 

0.3 -SEC TIME DELAY 
CARTRIDGE ASSY 

NO OUTPUT, EXCESSIVE 
DELAY OF CART FIRING 

4806 

2/1R 

THRU BULKHEAD INITIATOR 

NO OUTPUT 
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